You need GrapheneOS to sever the link to Google. You can also deny specify apps and services Internet access.
Allowing it to connect over Bluetooth requires granting AA plenty of additional permissions which I didn't want to do (but hey, on GOS at least you can muzzle that thing).
Another possibility is to keep an old/cheap, stock Android phone at home with WiFi only for apps like this.
The ability to control network connectivity for apps (and sensors) is really the killer feature for me. Maybe I'll give android auto a shot if I can figure out how to keep it from outside comms.