GrapheneOS Apps with this constraint depend on Play services and the Play Store, so why not install them from the sandboxed Play Store? That's much more secure and you can still use a throwaway account. Using shared throwaway accounts also creates potential security issues and is clearly against the terms of use.
Several apps like the American Airlines (AA) app don't allow installing to GOS devices on the Play Store anymore (says app is unavailable for your device), but if it was previously installed, it works and updates fine.
I should clarify that installing from a third-party source, although insecure, if the install source can be spoofed by Play Store by GOS, would allow Play Store to update and replace the app with a trusted copy.
The app itself does not check for Play Integrity. It runs fine if it was previously installed. However, it checks for its installation source to be the Play Store - for good reasons you mentioned. So this spoof would allow users to 'workaround' Play Store not allowing a first-time install, and then the Play Store can replace the app with a trusted copy in the next update.