They don't need completely bare-bones setup. Sweet spot for non-geeks is installing play services, which can be used without signing into an account and by default have invasive permissions revoked. Then installing playstore apps from aurora store.