But I want to use Secure Boot and TPM2 features. Just not with Windows.
You don't have to disable Secure Boot, just Device Guard / Secured Core.
Though keep in mind that'll limit your boot drive to 2.2TB in size. Not too much of an issue now for most people, but something to keep in mind during upgrades.
What? That sounds like forcing Legacy (BIOS) boot instead of EFI. Which shouldn't be possible on most machines in the last few years