By admin console, I mean a blank profile with nothing but stock Graphene apps on it. No Gplay store, no F droid, nothing. Its main job is to control esim, profile creation, duress pass, wifi..etc.

Or just a normal daily Main, with secondary profiles OR private spaces?

What i currently have: main profile with main Google (unfortunately), all sensitive in separate profile.