I won't use GrapheneOS. This video basically explains why: https://www.youtube.com/watch?v=4To-F6W1NT0
I use my stock ROM and followed the steps from this guide, with some changes like using Shizuku and App Ops, instead of AppOpsX: https://lemmy.ml/post/128667
I can confirm that when I restrict Google apps, including play services, it works. For example, if I block internet access for Google Play Services, I can't receive GCM notifications anymore. Beyond that, if there is some other backdoor that goes around my VPN and restrictions, there isn't much I can do about that.
My opinion on the video is that I don't trust the code of someone that is that unstable. If I were to go with a custom ROM, I'd probably go for LineageOS.