That's exactly the reason I simply don't install NoScript any more. It got old trying to find out which script sources provide functionality and which ones provide analytics. Sometimes one doesn't work without the other, that's where uMatrix usually came in handy, but that's an even bigger source of work. And I don't want to work, I want to surf the web.
So my current approach is to simply let them eat cake. Use Librewolf with a slightly different policy config, periodically purge website data and cookies, things like that.
Don't know about "essential" but if you're all about sending as little data as possible:
uBlock Origin as your AdBlock Plus-compatible, open source request blocker. Obviously.
uMatrix if you want absolute and unyielding control of all requests. Keep in mind, this is work everytime you visit a website.
CanvasBlocker, so you can enjoy Canvas without having a unique signature. Sends a random one everytime it's used.
Some may suggest Decentraleyes or similar so you don't use Google APIs everytime a website needs jQuery or such. Caused more problems than it solved for me.
SmartReferer which lets you define global and per-site rules which referer is sent to websites (aka where you came from). Some websites need you to come from the same site, like driver downloads from AMD, they prevent direct linking to the files with that.
Privacy Redirect, to use Invidious for YouTube, Nitter for Twitter, Bibliogram for Instagram and other substitutes. Only ever worked with YouTube and Twitter for me, almost all Bibliogram instances are permablocked by Instagram.
SkipRedirect, maybe. Some websites direct you to an intermediate page before directing you to your actual destination (I'm also looking at you, AirVPN). This addon skips this. It's possible because most intermediate pages are like "https://my.page/intermediate.php?url=https://the.actual.page/destination.php". Addon extracts the url= parameter and connects you there instead.
NeatURL, which removes common (and your custom) URL parameters like campaign trackers (utm_* and others) before the request is sent.
Hundreds more, probably.