I have an Amazfit GTR 2 which works well for me. The trick that I found is, you can actually use their official app to get the most features, and then just deny internet access, so that they cannot spy on you. Otherwise, it also works well with Gadgetbridge, which is a really nice app. In general I can advice to get one that works well with gadgetbridge!

I wondered, is the per application network toggle grapheneOS specific? I also recently discovered it and its so nice. Was a bit shocked when I red some indications online that its not a normal android feature?

There is a limitation on the amount of accounts? I didn’t knew that and that sucks …

Another idea if you are willing to spend some money is to get a yubikey. Then the tokens are stored on a separate hardware key and it has great android and Linux apps to access codes

I also recently discovered this and it is so nice and genius

I can recommend the book Daemon which explores that Idea