So graphene is the starting point, because it offers security (and sandboxes google play.) F-droid has reasonable policies to protect you from spyware by excluding non-open framework use (I'm not sure if gms is allowed.) This is already 200x better than any app you download from the play store.

However, if you're an actual target because of what you work on and a somewhat-pleb, then applying "don't trust, verify" becomes really important. So I just download source for everything, review the code (search for patterns), remove all the crap like gms, remote debuggers, call-home functions that aren't needed (they never are) and compile it. Then I packet capture the app and use it and see what it does on the network side, and audit storage.

This is way too much work if you're not a target. Just using f-droid should be good enough.