Based on quick testing, disabling every possible permission on Play Store and Play Services still allow users to purchase download apps from Play Store.
Referring to the Open GApps Pico package for the absolute minimum GApps installation:
- Google System Base (invisible?)
- (Google) Android Shared Library: no permissions requested, cannot be disabled
- Google Play Store: only requires Files and media
- Google Calendar Sync: unrelated to Play Store
- Dialer Framework: unrelated to Play Store
- (Google) Package Installer: no permissions requested, cannot be disabled
- Google Play Services: only requires Physical activity, though unrelated to Play Store, cannot be disabled
- Google Text-to-Speech: unrelated to Play Store
- Android Auto stub: unrelated to Play Store
However, this only guarantees app purchase and installation. Apps that rely on Google Play Services might not work correctly without additional allowed permissions.