Your only reasonable option is one of the current generation scanners that do P25 trunking (including Phase II TDMA). You can get into one of those for several hundred dollars.
OpenSky is not monitorable. Except by a radio that is authorized and part of the specific OpenSky system that is at issue. No scanner will monitor it at any price.
What else will a scanner be unable to touch?
Anything that's encrypted.
ProVoice, usually associated with EDACS systems.
MotoTRBO in any format
NXDN in any format
The two way radio option is, as described earlier, not for the inexperienced. There are WAY too many ways to get into trouble with that sort of a radio. Consider that those radios are DESIGNED to talk on those systems. You have to do some very cute tricks to make them NOT transmit while still being able to listen, and some of those tricks require deep knowledge of the radios and/or the systems.
No single commercial radio will even handle a combination of EDACS and Motorola formatted trunking systems. (Smartnet, Smartzone, Astro)
Granted, it is fun to mess around with these radios (as I do) but I do not recommend that you do it. If you do, you WILL be venturing into the shadows. You WILL make mistakes. Radios that you didn't
intend to transmit, WILL transmit and you will have to figure out how to stop them from doing it before somebody notices. If that somebody is NICE about it they'll just deny your radio on the system. If
they're a hard@$$ about it they'll try to find you.
Buy a new scanner with all the bells and whistles. Please. You'll get to hear more than you could with any SINGLE mobile or portable public safety radio and never run the risk of getting into troublesome territory in the process.