I feel like several of your problems where you “have to” do this or that, you’re missing the value of iCloud “child” accounts that can be enabled to use the parent account’s things they didn’t pay for.

Especially for the literal kids, use a child account. But also use a child account for the work machine so it can use your apps but isn’t your personal messages and photos.