This is a config I was rocking with my older phones as well.
- Sophos Mobile Security is a beast, a bit heavy on the battery though, but even now I manage 1 whole day without issues.
- AdGuard and Nord VPN.
- Knox encrypted.
- Not rooted - I was rooting every phone before - I had absolutely no need for it on S8.