A question on the business logic here: A tag can be private (Tag.isPublic !== true) but shared, hence the need for point 3? If that’s not the case, then the query you have would accomplish it.
Filters on the count of an edge can be done in a custom query or in DQL. Or you can use the query you have and do these checks from your app.