Honestly I’m not technically knowledgeable enough to answer, you can have a read of their FAQs. But my understanding is that the sandbox allows some google services to be used, but without privileged access to the rest of the system. As opposed to blocking them entirely, which would mean you couldn’t use those services at all. https://grapheneos.org/usage#sandboxed-google-play

I use GrapheneOS and NextDNS. And NoScript. There’s some overkill there but I figure why not.

To your question, GrapheneOS has put a lot of thought into features like sandboxing Google Play services so you can choose to use none/some/all depending on your preference. I would think that’s probably a smoother experience than trying to block google services selectively via NextDNS. GrapeheneOS also makes it easier to manage per-app permissions and security features.

The Mirror website is cancer. I use NoScript and it won’t load without allowing about 50 fuckkng scripts. MSN too. I avoid both but occasionally click on a link from elsewhere