There's a clean way to vet any of these without guessing. The single tell: when you connect, does it send you to Instagram's own login screen (OAuth), or does it ask you to type your username and password into their site? Password = it's driving your account through the back door, which is against Instagram's ToS and the actual thing that gets accounts restricted. Instagram's own login = official API, and the tool never sees your password.
With the OAuth route you also get a consent screen that lists the exact permissions before you approve. That's where your specific fears get handled: a tool can only read DMs if you grant instagram_manage_messages, and only post if you grant instagram_content_publish. Scheduling/analytics tools like Later or Planoly typically only ask for basic profile, insights and publish, never messages. If a connect screen asks for messaging or more than the job needs, deny it.
The honest part though: Instagram's official API is deliberately narrow and doesn't offer audience targeting or discovery. So anything marketing itself as automated targeted growth is usually one of two things, either analytics/hashtag research with a growth label on it, or the risky category that needs your password to auto-follow and DM. For pure audience discovery that never touches your account, look for tools that only read public data (no login to your account at all).
On plixi vs Later/Planoly specifically, run them through the same test: does it use Instagram's login screen, and what exactly does it do once connected. Later and Planoly are schedulers on the official API. If plixi is doing automated engagement to grow you, check how it connects before trusting it on a business account.