I'm not sure I understood every question correctly, but I tried my best:
Apps isolated by Insular shouldn't be able to grab your personal information. But AFAIK they will still be able to grab device-specific information (like your IMEI).
This is up to you. But given how privacy conscious you are, you should probably go with the Graphene as main phone.
It most certainly is safer not to use aurora apps - in general. Simply because of their proprietary nature.
Other than the facts, that
1. no WiFi-AP can log your Android-phone's MAC
and
2. all apps on the A-phone that like to log the MAC of the connected WiFi will log a randomized/useless MAC (if Graphene is setup this way),
I see no real privacy benefit in this.
This is still not an effective tool against WiFi triangulation, because your phone will still gather the MACs of all other surrounding WiFis.
And if your necessary apps phone home, all data they gathered still runs off to the companies.
Of course, when combined with Insular, the data they are able to gather is limited.
In this regard, I don't think there is much of a difference between connecting the A-phone through Graphene or connecting it directly.
In theory, by connecting the phones, malware could spread from one to the other.
But again, it depends on you and how likely you find such a scenario.
You should probably do a lot of reading on the threats you find the most important/areas where you see yourself at risk.
That way you gain an understanding of what to do/avoid and a general sense of how likely certain things are/how much effort adversaries would have to invest.
You really need to figure out your own, personal threat model. There is no one-size-fits-all solution.