[Samsung Galaxy A3, A5, A7 (2017) ROMs, Kernels, Re] starbright_:
Update - 2020/10/07:

As I did have trouble (not sure why) I go my own way based on [MENTION=7764250]obifur[/MENTION] and others pre-work. I wouldn't create a new How-To but I did have problems with the others. My setup is a bit shorter and leaves few steps.

Maybe I am not finished right now and tests have do be done but not to lose my findings I write it down:

To not spread infos during installation to Google/Samsung/... I removed SIM-card and selected Wifi only after installation is completed and firewall installed from FDroid (download the afwall.apk by PC and put it to SD-card for later installation).

Detailed Steps:

Preparation:

Download a few needed apk files from fdroid.org to microSD-Card.

FDroid

AFWall

Adaware

microG core (rename the recent version to GsmCore.apk (https://xdaforums.com/apps/magisk/module-nanomod-5-0-20170405-microg-t3584928)

This allows you to block unwanted traffic before you can install the highly recommend OpenSource Software Store FDRoid

download ROM from: https://www.sammobile.com/ (you need to register). I used latest A320FL.. for my country - it is from 2020/07. Not sure how important country is, because of the basenband/radio settings.

Enter Download Mode (press vol.down + home + power on) and use Odin3: (https://xdaforums.com/showthread.php?t=2711451) to flash ROM

flash stock ROM (BL, AP, CP, CSC), untick auto reboot.

Enter Download Mode again

flash custom recovery TWRP (https://dl.twrp.me/a3y17lte/):

Use .img.tar file and flash via Odin3 in the AP-slot ..and be ready when device reboots after finishing flashing.. see next step, untick auto reboot again

boot directly (!) into TWRP (press vol.up + home + power on, until Display shows "Galaxy..")

to be able to mount /data choose "format Data"

install "Disable_Dm-Verity_ForceEncrypt_Quota_03.04.2020.zip"

(https://xdaforums.com/android/software/universal-dm-verity-forceencrypt-t3817389)

(add "quota" in the filename to disable it - otherwise it won't work!! This step is required for TWRP being able to mount /data after reboot because TWRP doesn't seem to support Quota)

install Magisk-v20.4.zip

(https://xdaforums.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445)

boot into system and execute setup wizard - without SIM card and Wifi enabling

enable access to phone data

enable developer settings

enable USB-debugging in developer settings and enable adb access always.

In Windows/Linux terminal try to open "adb shell". Sometimes it fails. There should be a pop up that you trust your PC for connection. (During my test I found sometimes this takes some time and I need some attempts unplug/plug ... - not sure why).After you entered that type "su" and grant the Magisk root permission for that. If this is not working the next point (spoofing) will fail probably and error is not well describing the issue).

Prepare Signature Spoofing:

At Windows use SmaliPatcher.exe to create your installable zip-file with de-odexed services.jar etc. and copy to your device (https://xdaforums.com/apps/magisk/module-smali-patcher-0-7-t3680053). Then:

Enable Signature Spoofing by booting into TWRP and flash that new created zip.

Debloat the system by script here (https://xdaforums.com/showpost.php?p=83651689&postcount=177)

copy GsmCore.apk to /system/priv-app and give it permission 755

(Wipe cache/dalvik is not required as done in debloat script)

reboot into System

open microG settings, selfcheck and grant permissions

to receive push notifications (afaik) it is required to enable Google registration and Cloud messaging.

Now you can install Firewall, enable Wifi and plug in Sim.

install FDroid and add repo: microg.org/fdroid/repo

install via FDroid the other missing parts of microG: FakeStore, micrGServiceFramework, nominatem, ...

That works, check for updates here - maybe I have to change or add some things....

What I am wondering: How to update once Samsung creates a new security patch !?

Chrome is not debloated as there was a report that this seems to be required. I'll block it in afwall.