Disable autostart on boot and restrict background execution

Without getting into the details whether or not one should stop autostarting apps, and what could be the consequences as discussed in a plenty of other answers, here are my simple solutions which may work without any third party apps, at least on Android Pie.

ROOT SOLUTION:

Apps use BroadcastRceivers to listen for broadcast ACTION_BOOT_COMPLETED so that they can run on boot. Broadcast receiver is an app component that can be disabled with root privileges.

Using Package Manager list all broadcast receivers listening for BOOT_COMPLETED:

~# pm query-receivers --components -a android.intent.action.BOOT_COMPLETED

It will give a list of broadcast receivers in format package_name/component_name. See dumpsys activity broadcast-stats and dumpsys activity broadcasts for more details.

Now to disable a component:

~# pm disable <package/component>

There are apps like Autostarts (com.elsdoerfer.android.autostarts) and SD Maid (eu.thedarken.sdm) which can do same for you. File /data/system/users/0/package-restrictions.xml can also be edited directly to disable apps or their components, but it's not recommended.

It's possible to disable multiple broadcast receivers of an app, and a single receiver can also possibly listen to multiple types of broadcast events.

NON-ROOT SOLUTION: (non-universal)

In order to receive android.intent.action.BOOT_COMPLETED, apps need android.permission.RECEIVE_BOOT_COMPLETED which is a normal permission and hence can't be revoked by user.

However there is a hidden permission management framework, named AppOps that provides a slightly more fine-grained control of (permission-like) operations. OP_BOOT_COMPLETED is one of those but it's not a part of AOSP, only added by some custom ROMs like LineageOS. If you are on one of such ROMs, you can control the autostart behavior through adb shell:

~$ appops set <package> BOOT_COMPLETED deny

Now the app won't be allowed to receive BOOT_COMPLETED broadcast. There are apps like App Ops (rikka.appops) which can do same for you. Some custom ROMs have built-in front-ends to AppOps with different names like Privacy Guard, AutoStart Manager etc.

Please note that AppOps:

is not generally intended for third party application developers; most features are only available to system applications

So its usage without root may be disallowed or get harder in next Android releases.

Both of the above methods can stop apps from starting on boot only. An app can listen for some other broadcast events too and it can keep on restarting if killed, or run in background continuously (as a service) if it's designed to be so. See dumpsys activity services for more details.

A slightly different approach would be to stop apps from running in background by using OP_RUN_IN_BACKGROUND (introduced in Nougat) and/or RUN_ANY_IN_BACKGROUND (introduced in Pie) which are part of AOSP:

~$ appops set <package> RUN_IN_BACKGROUND deny

They don't have an equivalent manifest permission, but there is an experimental permission with same name.