My aim is,
1. Use same address every time, a1
2. a1-primary-key can not be used to spend the funds from a1
3. I want to use new key every time to sign future trxns
Basically, a1 is just a dummy / constant address and fund from this address is controlled by another address..
Impossible by definition. As I explained earlier, an address specifies what key(s) can be used to spend coins sent to that address. By definition, if a key cannot be used to spend coins sent to a particular address, then that key is not (and never can be) related to the address in any way. If a particular key
is one of the keys associated with an address, then it is (and always will be) able to spend coins sent to that address. That's how the key-address relationship works. It is also not possible for one address to "control" another (whatever that means).
If you want to require that a different key be used for every transaction (and you still haven't explained
why you want to do this), you must create a new address for every time you get paid, and tell your payers to only send coins to your newest address and not re-use your old addresses. (This is the recommended method of using Bitcoin, as it allows you to label each address with the reason you expect to be paid there, so you can more easily tell who is paying you for what.)