I have an iPhone and a gl.inet gl-e750 portable cell router, and my SIM card stays in the router. I don’t actually restrict my phone the way you’re talking about, but this gives me vpn to my home network without needing the vpn running on each client device. And if I wanted to block connections to big tech company services, I could do that.

Apropos of nothing, my ham radio call is NO0K, November Oscar Zero Kilo. If I decide to do the ham radio license plate thing again, I should pair it with some kind of Tom Nook sticker or something.