A common theme with #GrapheneOS folks is that they make their setup to complex and end up hating using it.

I like the basic "public" vs "private" profile setup that I lay out above. 

I use a SIM (Mint Mobile) and a couple eSIMs (Tello, Silent Link) which require sandboxed GP. I set those up on my public profile.

Instead of leaving the main one stock, put all your normie usage in there so if you are forced to give it up, the usage looks convincing.

The private profile gives YOU the choice to say "Fuck You I Lost It" -Saylor.