Is your friends client config setup for split tunneling?

If the client config installs a default route to the VPN you will get all their traffic.

The server config can refuse to forward traffic to the internet, but then your friends will be effectively on your LAN but otherwise appear to have no internet access.

Its a good idea to restrict which IPs on your LAN they can access, but the client config also needs route only those IPs over the VPN.

https://www.privateproxyguide.com/how-to-set-up-split-tunneling-with-wireguard/

Password manager. Bitwarden does this. Signal too but that falls into your social media category.

The work profiles are meh (due to employers, not Graphene). My employer restricts what can be installed in the work profile. So I can’t install sandboxed GPS. Therefore, none of my work apps can run.

I’m sure there are ways to make it work (e.g., shelter). Decided to tell them to provide me a work phone instead.

https://csa-iot.org/all-solutions/matter/

See if they will implement this? Backed by Apple, Amazon, and Google. HA had support last I checked. They have bridging support also like ZigBee to Matter for Hue bulbs.