I finally decided to go with <service>@domain.tld.
In the end, I think that trying to receive zero spam is a lost cause, that can only be achieved by not having an email address.
In this case, if an email leak, I can know who leaked and fill a report against that website.

If I start receiving spam I can blacklist the domain if it's a single one, or train spamassassin by putting it in junk.

I'll also subscribe to a bunch of blacklist amd setup a BGP peering to retrieve a dynamic blacklist and block them with pf directly.

Finally, I added a spamtrap/honeypot on my website so I get spammers to send mails to that address first and greylist them right away, which has the added benefit to waste their resources (thank you spamd!)

Thanks everyone for your advices :)