Why do APKs never seem to be available directly from the developers, but only through third-parties?
If you'd install apps from the developers website directly, you had to trust each of the developers personally that their apps do not contain any malware etc. That's why there are "app markets" (see our alternative-markets tag-wiki for details). Choosing wisely, the user then just needs to trust that market to do the necessary checks. Most of them have such checks in place:


Google Play Store has e.g. its "bouncer"
F-Droid compiles the apps from the resp. sources, which it checks beforehand
Aptoide uses several sources to validate packages (e.g. VirusTotal, comparing signatures, and more).


Besides (and the last item implicitly mentions this), developers provide means to check the validity of their .apk files: they sign them with their certificates. Only the dev has the "private key", and validity can be checked using the "public key" – or simply the key's finger-print. Which is what e.g. Aptoide includes in its "malware check": It compares if the finger-print matches with what .apk files of the same dev from other sources (mainly Google Play Store) shows.

As your device doesn't ship with Playstore (and I fully agree its permission hunger is excessive), I would recommend you using F-Droid. Their repository isn't nearly as big as Googles, but the security measures are good. And you can use additional repositories with their app to cover a larger pool. I definitely and strongly discourage using .apk files you found "somewhere in the wild" unless you know exactly what you do (i.e. either you can trust the source, or know how to check the .apk for yourself to establish trust).