I need to use of Google Play Store app for my project. This app is prepared by unknown to me Chinese GPS devices' manufacturer and I want to use it to communicate with device.
App is published on Google Play Store but uses old type of privileges. With installation I would agree to share "Device & app history", "Contacts", "Location", "Phone", "Photos/Media/Files", "Camera", "Microphone", "Device ID & call information" and more.
I don't feel comfortable to share all that data with unknown to me manufacturer and with untrusted app (1 star in shop), but I need to use this app (because it connects to my physical device).
Is there secure way to install that app? Can I be sure that for example app won't copy all my contacts to some shady server? (I can't block network for app, because that would also block communication).
How can I mitigate some risks or limit app capabilities? Should I be aware of some other risks (like app accessing Android Pay)?
I have OnePlus 3 with Android Oreo (stock but in open beta).