This depends on what you’re trying to defend against. In my opinion (on GrapheneOS), the “Network” permission, “Modify system settings” permission, “Install unknown apps” permission, and any permission that allows apps to communicate with one another (such as a reduced sandbox, file permission, or app communication scopes). Those are the only permissions that I can think of off the top of my head that could potentially allow an app to phone home.