Objective: Keep all the data in phone (including SD card) protected unless it is decided otherwise.
What other way I have tried (and failed): Using Adoptable storage. This is what I did with my previous phone. With BlackBerry Key2, I can no longer do it, because the phone uses file-based encryption (opposed to full-disk encryption) and Android 8.1. However, Android does not support for combination of FBE and Adoptable storage until Pie (9).
What I am trying now: Because I can't have Adoptable storage on my phone until Pie upgrade, I have decided to insert a SD card (as a Portable storage, since I have no other option) and move all Spotify tracks there, as those aren't much confidential data*. I have declined any suggestion to move any data (except Spotify tracks). However, some other apps have also created their own directories in /storage/some-identifier/Android/data/. In many cases, they are just empty directories, but there are also some files. Can I prevent it?
*) Well, with some effort, one could infer my downloaded tracks. Even without decryption of DRM-protected songs and without any metadata available, one could detect it by file sizes.