Android has an Enterprise feature that allows devices to have an isolated "Work" profile from their Personal profile, complete with separate accounts and apps (though your device IDs are still likely shared due to it being the same device)

There's this project called Island that allowed anyone to set it up on their own devices

Insular and Shelter. Apparent Shelter is more secure but I don't know enough to tell myself. https://secure-system.gitlab.io/Insular/faq.html

I use Shelter from F-Droid to create a work profile and then install RethinkDNS on that profile which blocks any trackers from the "bad" apps (you can add a tonne of blocklists). Additionally, if you have a Pixel, GrapheneOS has total app isolation (including storage scopes) so Messenger only has access to what you allow.

there is always the option of carrying a second device. physical separation is best separation

this doesn't matter but I found it interesting bc of all the people recommending tools like shelter and insular, using profiles or work profiles to separate data would be siloing not sandboxing.

edit: with that said, as others have pointed out, apps are already sandboxed on Android. they can only really communicate with mutual consent ipc. so say for example, Google services can communicate with other Google apps because they both explicitly call for each other. while ipc is still technically something to think about, the mutual consent requirement makes it somewhat difficult to make malicious use of it.

apps aren't capable at accessing other app data whenever they wish, though. even with storage permissions granted it only really has access to user directories (downloads, documents, etc.).

edit2: additionally, it's worth noting that using any profiles (work or normal), will increase ram and battery usage by a decent margin as this will make a second user with all system apps running alongside your main user.

any solution involving root should also be considered a non-option as well, since gaining root access completely cripples androids security model.

Android apps are already sandboxed. You don't need to sandbox them further unless you're giving them permissions to peek out of that sandbox.

Edit: Also would like to add x8 sandbox to the list. It emulates its own android instead of using profile management features like the other apps mentioned. Since it's proprietary I wouldn't trust it (and it does have a performance impact), but wanted to throw it out here.

Work profile with Shelter? Run GraoheneOS?

I am by no means an expert and I'm def interested in what others have to say on this issue as well.

I use Greenify and it allows you to quarantine apps and run them on an emulated version of Android. So there's one option

Insular uses the work profile to isolate apps.

Or you can add a whole new user to the phone and switch between them when you need

I offer android container https://github.com/twoyi/twoyi

Either multiple users or hide my applist lsposed plugin with all data isolation enabled idk

If you are on Samsung devices, there is 'Secure folder' which basically is 'Work' profile.