If you can’t change device, I would avoid any native app and use Ironfox .
Harden it: go in Settings > Ironfox Settings and disable printing, WebGL, JIT , WASM. Also disable Add-ons, but check that this doesn’t remove uBlock Origin. This will break many (*) website, but it is crucial. Unlike for modern Android versions, any vulnerability in the browser engine could easily lead to full device access.
*Not as much as you think, perhaps 5-10% of websites, depending on how many modern (advanced things, such as interactive maps) websites you use.
Also consider using Shelter (work profile).