I’ve had great success getting around these restrictions.

CalyxOS + Always on VPN (mullvad)

The secret sauce is using a Android version that allows you to share your VPN with hotspotting. I believe only calyxos and lineage allow you to do this. Since the VPN client is running on the phone, all the traffic that originates from the phone will look like phone data, with the appropriate time to live, OS fingerprinting, etc.

This can’t be done on stock Android, because it does not allow the VPN to be shared over tethering. So tethering traffic will not getting capsulated on the VPN client. There’s a security argument for this, but I prefer the user flexibility of allowing all the traffic to get VPNed.

It’s still possible to do this without VPN sharing on the phone, you can use normal tethering on a unlocked phone, like stock Android. You just have to modify the traffic signature to look like whatever the carrier is looking for. Setting the appropriate time to live, using a VPN, and doing other OS fingerprinting tricks to keep the traffic consistent. It’s much easier to use a ROM that lets you share the VPN