I use decentraleyes and block js from loading using no scripts, I use a few other extensions two but those are the main ones

Idk if this will work but I know on android you can set it to block connections that don’t pass through a vpn in your settings

I went with an onn4k not logged into a google account because I got one that was patched to keep you from replacing the os with lineage but if you get the right version you can change it to lineage and put the apks for any services you want onto it

I like cloudstream personally and jellyfin is also pretty good

I used kde connect to load the apps onto it by downloading f-droid and loading apk files that way