I’d maybe get more familiar with what HubSpot tracks. Maybe get a free account and create a few pages and mess around with it.
If you throw the tracking code on an external website, there isn’t much that is just tracked by default in regards to events. It’s mostly page traffic data related to source, sessions, time on page etc. I’d argue similar to Google Analytics, but GA is more feature rich. If there is sensitive information in URLs, you might want to remove tracking from those pages as I’m not sure you can obfuscate those, but generally you shouldn’t be doing that anyway. HubSpot will tie page view information to actual people once it knows who they are. It’s not anonymous like GA. So if you have some sensitive pages and you don’t want them to appear as “viewed” by a user, probably remove tracking from those pages.
HubSpot by default doesn’t do heatmap tracking or event tracking. It doesn’t record partial form fills, or specific page clicks etc. You can add behavioral event tracking to monitor things like that using the features, but by adding the tracking code I don’t believe you’d run into any of those issues you are worried about. You could enable things like non-hubspot forms which might have a site-wide undesireable effect in your case. Adding CTAs would track some click information automatically. But again, all of this is added by the user, not something that’s just observing and tracking out of the box.
Mainly you’ll get page/traffic data out of the box without doing anything.