Don’t link or setup an icloud account.

Have a admin account, never use it

Run everything from a unprivileged account

Use virtual machines such as UTM to segment your different workloads.

Only allow the admin user to decrypt the hard drive. I.e. on first boot you login as admin then logout then login as your daily driver

Never, never, install anything that needs admin privileges