I have a similar setup and decided to install it on my degoogled phone because I definitely wanted to use a VPN to connect to Whatsapp and my other phone is an older Android without the global VPN option.

I have it completely isolated from my main account by using Shelter from F-droid, installing Aurora store in that sandbox and then installing Whatsapp from Aurora into the work profile created by Shelter.

This way, my main contacts and media are not accessed by Whatsapp. It does its own separate thing and I have no other apps interacting with it.

You can setup a matrix server and use whatsapp via a bridge.

What's "zero hours contract"?

There are concerns with a company requiring any tool but not providing hardware to use it. That's bad practice from a corporate perspective, and opens them up to litigation connected to whatever is on that device. This is CTO/CIO Risk Management 101, and why companies provide devices that are heavily restricted.

if you need only the chat (i.e. not calls) you could self host an instance of matrix with the whatsapp bridge. In this way you won't need the whatsapp client on your phone (other than for signing up and connecting the bridge once) and use it througth the matrix client (e.g. element).

If telemetry is only what bothers you, you should be able to block it. Pi-hole can block telemetry so you should be able to do this with some app too for example https://f-droid.org/en/packages/org.jak_linux.dns66 and https://nextdns.io

GrapheneOS let's you run Whatsapp in a Work profile that's sandboxed away from your real data. You might have to install something like Insular from Fdroid to manage it.