I have the yubikey bio so no nfc. And for OTPs I use Aegis independently. When I did my research back then, it didn't look like this would change in the future... Unfortunately😥.
As a workaround, you can install the Google services in another profile... but unfortunately this is not a nice solution either. 

 No, that really sucks.. I want FIDO2 security and no proprietary software on my GrapheneOS phone. Fuck Google play services. 
Thank you so much for your first hand experience! 🙏 

 You're welcome.
If you find a solution with an alternative product, please let me know.