This might be a question best directed to T-Mobile directly.
Here's the link to their official policies, though this one is specifically for carrier unlock (so you can move service to a different company) instead of the all-important OEM unlock capability:
Again, I encourage you to check with T-Mobile directly to be sure, but my guess is that the phone will have the OEM unlock feature disabled, thus making it impossible to install GrapheneOS.
Here's the line in their policy that I believe they may default to, even regarding the OEM unlock feature: "If the device was financed or leased through T‑Mobile then all payments must be satisfied and the device must be paid in full."
I could very well be wrong, indeed I hope I am, but personally wouldn't risk buying the phone with the intent of installing GrapheneOS unless the OEM unlock ability is confirmed. Maybe try it physically in store and check? You'll need to be sure the phone is online, wifi is fine, as the device needs to reference its serial number against a list of them on Google's servers to confirm its OEM unlock status.
Lastly, I've seen some posts regarding OEM unlock bypass, using various SIM swapping tricks. These may work, they may not. I'd be very careful about relying on those, however. Exploits like that can work one day, and are closed when you go to try it. Good luck, and hope you find a definitive solution/answer.