For this use case, I use a burner Google voice number, give that to Whatsapp and don't give it access to my contacts or anything on my phone. Late model phones don't give apps IMEI or real MAC.
It's not perfect: when you connect with people they can easily associate your WhatsApp account with your identity (add contact) and also share info/pics/etc about you that you wouldn't want shared. They can do this even if you're not on WhatsApp, and Meta can use face recognition and other techniques to create a profile for you, then associate that profile with the other days and profile they have for you. It's trivial to narrow the down to a few million users then match on photo etc. Unclear if they bother, given that 99% of users just give away their privacy.
Also, Whatsapp verification uses SMS. If they'd used a verification URL, they could've (bounced through) Facebook.com, Instagram.com, etc and associated the account via (first party) cookies. I'm guessing they don't because 99% of users happily give the app all the permissions it needs and SMS is more universal.