Try DivestOS for your app issue - it’s not as locked down as Graphene, but it’s really good.
I prefer it over Graphene on Pixel. It’s barebones Android with open-source apps for browser, file manager. It doesn’t have Google Services, you can install MicroG to the work profile if you need it for certain apps, and isolate them there.
I like to root it so I can run apps like AF Wall for managing IP Tables (the native firewall in Linux, which Android has).
If you add a DNS tool like ReThinkDNS, you get some really granular control over DNS resolution too.