which one should I install to get push notifications working?
You need to install all three then activate Google Play Services by opening Google Play and going to the sign in page. You should then give battery optimization exception to Google Play Services by going to Settings > Apps > See all apps > Google Play Services > Battery and select unrestricted. You may need to reinstall protonmail after that. Apps usually don't detect GP Services if it's not present when they are installed.
Also, can google read my notifications?
Depends on how the app is made. If the devs aren't too dumb they just send a ping to their app telling it to fetch the notification from their server. If they are lazy they will send the whole notification through firebase.
If I install the official google camera from aurora store (together with gcam services provider or sandboxed google play), and install google photos aswell. Then block network access from both of these 2 apps, can I use them privately?
Do not install gcam services provider, it will cause issues. Install Google Services Framework instead. It's the same and it does nothing on it's own anyway so this won't impact your privacy. You can revoke network permission from it without issues. Google camera can easily be used privately with network permission revoked from GSF and GCam. No idea for Google Photo but I would assume the same even if some features definitely require network access.
Note that all privacy guaranties are lost if they are installed in the same user as Google Play Services.