Waxillium or will it not work since I don't have Google services downloaded on that profile?
I don't know. I never tested without Google Play. Just know that people have had issues with Play Integrity and location in the past, so I tested to see if they were a problem for me too. That was a while ago, though, before GrapheneOS added network location. If you use GrapheneOS's network location, then it may work, but I also wouldn't be surprised if Pokemon Go checks for Google Play and Play Integrity.
Waxillium I don't quite understand if those "sandboxed" apps allow me to keep my data private
Far more private than the stock OS. On GrapheneOS Google Play and the other apps are all installed as regular apps without any privileged access. You can get an idea of what regular apps can access on top of permissions you grant them by reading the hardware identifiers section on the website as well as the following one on non-hardware identifiers.
I'd say two of the biggest reasons people install Google Play in whichever profile they use the most for two reasons: getting apps and push notifications. If you want both of those in your main profile, I'd say go for it.