I've had good luck so far with GrapheneOS. I still have Google Play but it only has normal app permissions, and it's in its own user profile that stays off unless I need to use an app that uses Google Play. I can install from external sources just fine, including the built in browser. Google Play Store is also an external source with Graphene's setup.