Grapheneos with a dedicated profile with those China apps. Dont allow the profile to run in the background. Then just use tor with snowflake or one of the many methods of tor to bypass the firewall of China.

Only the pixels phones allow for relocking the bootloader with a custom ROM. Might be possible on a few other devices when jumping true a load of hoops and potentially bricking the device.

Any supported phone with lineage OS? Primacy is really good but not as much security focused as GOS