... 2/3
If those are non-starters for you, the only other option would be to use stock android with something like TrackerControl to block some of the google apps from the internet, but then you're routing everything through TC, and you're losing your one-and-only VPN slot to that, and dealing with a more cantankerous system... eh...
... 2/3