> and even then it's hard to know you did it correctly

At that point, why not copy what people do with android? Just run a dummy "vpn" on your system that null-routes traffic going to microsoft-controlled domains or IP blocks. By no means a perfect solution for sure, but a really good one in practice.

You have remember to clear the telemetry cache and reconnect your system to microsoft to get updates from time to time.