I got Debian Stable working with a bit of fiddling.
At the time, Buster was the current stable release. Since Buster's kernel was too old, I had to manually configure my installation to pull the kernel from (prerelease) Bullseye using apt pinning, but now that Bullseye is the current release, that's probably unnecessary.
I also had to do some manual work to get a working bootloader, as
described here. It's possible that the latest installer version knows how to install a bootloader for the RockPro64 by now. I saw some of the components already in place when I did this last year, but I haven't gone back to check on it.
I've upgraded to Bullseye since then, using Debian's standard upgrade procedure. The system works well, except that the ethernet device sometimes
fails to come up after a reboot. That can be fixed either by reloading the dwmac_rk kernel module via serial console, or sometimes just by rebooting again. This might be a problem in the upstream kernel / device tree. It's a headless machine, so I don't know how well video output works.
The system drive is a spinning disk encrypted with LUKS. The bootloader and initrd are on an unencrypted SD card. The ramdisk loads dropbear during boot, so I can enter the LUKS passphrase either via SSH or at the serial console.