I don't have a VM suggestion, but I'm in a similar situation.  I keep my phone tethered to one place at home, and never access it directly, or take it with me anywhere.  I installed a Lineage OS on it, and make use of the multiple user accounts feature.  The primary account only has free software.  A secondary account has only "important" things like banking and government stuff, and a third account has only relatively untrusted apps that I might need once in a blue moon.  I have ADB over TCP enabled on a Wireguard VPN, and access my phone from my desktop or laptop through scrcpy[1], and I have Termux installed on the primary account, with an sshd server running at boot, listening on the VPN too.

[1]: https://github.com/Genymobile/scrcpy