Install them on their own separate profile - they can't access any other data on your other tablet profiles - ever. Why degoogle a pixel & install Graphene OS?. Use separate proflies (easily switchable logins) to maintain hard separation of what you want to do.
eBay