Ordered by preference, cascading down when it's not present

• F-Droid : I'm used to it and know it relatively well
• Accrescent : comes from GrapheneOS but very few apps
• Obtainium : works well, very interesting principle, but limited shared configuration
• .apk from Website or repository : no reviews so have to do due diligence, updates also manual but just works
• Aurora : that's my ultimate fallback. I install it, use anonymous mode then uninstall it.

And yes FWIW I do believe obtaining apps for GrapheneOS is the most challenging part. Installing it with the Web installer was trivial. Using it is great, very convenient. Getting apps which are not in F-Droid, not straightforward.

there is aurora store

https://gitlab.com/AuroraOSS/AuroraStore

I personally use F-droid, then play store myself

Moblism is pretty useful

i use f-droid for most apps (Free and open source), and aurora store (its on f-droid too) for google play apps. technically, aurora does access google play servers to get those apks, but so does any other site that would share those apks, so.. no account is needed for this, btw.

generally, avoid downloading apks from the internet, its risky af.

I use Obtainium. It's not a store or repo, so I have to manually find the apps I want to install. I even prefer it over fdroid: I might search for apps on fdroid but then go to the app's repo (on codeberg or github, etc) and try to install them via Obt ainium. But 98.6% of the time, I don't use fdroid to search for apps - I find them mentioned on Lemmy, in my RSS feeds, searching the internet via searxng.

Part of degoogling is finding alternatives to proprietary options and the play store, like Immich, while I find not all people are apt or even willing to host their own services, programs like syncthing can help in the interrim.

I know, but you neeeed Synology. Think of it more like, you need your photos, they're just in the way.

If by malware you do genuinely mean those that exploits vulnerabilities on your system to gain unauthrorised access (as opposed to apps that have heavy telemetry), I think apps from official sources are sufficient like Play Store or F-Droid. Malware will usually ask you excessive number of permissions. Deny them whenever possible. Installing them in second profile would make the damage contained.

But since you said degoogling, I would go with F-Droid, or directly from GitHub, where most apps are open source. Obtainium is a great tool to manage those applications. Last but not least, denying network access can block some telemetry on apps that don't require network to function.