I set up my own Windows 2019 domain for this same reason and ended up having to go over basically every available GP over the course of a weekend. There are just too many, and a lot of them require careful reading to know what they actually do since MS options tend to be in the form of "Enable the disabling of something" lol. Even the telemetry option itself is like that, since turning it "On" and to Enterprise-only level 0 leaks less data than turning it "Off"
https://i.imgur.com/0Iplagu.png