Probably not. Which means - work phone should be entirely separate from your private device, not a dual sim.

Have your work phone forward messages etc to your private device if you must, but enforce the hard boundary yourself if IT won’t won’t provide you with separate device.

No. AOSP itself has little to no tracking. All the tracking/spying comes from Google Play Services which are automatically updated to the latest version. Also those are installed as system apps so they have greater access to OS functionality and normally you won’t be able to change the permissions.

In my case I need one app for generating RSA token to login to system. But somehow it works on GrapheneOS. I have created separate profile for that and installed just that 1 app. And during registration we need internet access after that that’s not even needed so I’ve even disabled internet access. And it still works. Check if something similar can be done in your case. But be careful some companies force you to BYOD but then restrict saying you can’t root or use custom ROMs.

As others have said, no because Google’s components have very good backward compatibility and will come for your device on its stock OS.

I had other vendors in mind when I first read your question. In a sense, older ones could spy less as a side effect of vendor telemetry servers going dark over the years. Samsung also wasn’t as rampant with their spying back then. But either way, such phones would have been long without any security updates.

Keep your work phone and have a fun phone with LineageOS without GApps (don’t even install microG)