ProPa however I'd probably need some apps to run natively on the OS and that's where I'm not sure what to do about it. Is there any official, GOS approach to this?
I believe the official approach from GrapheneOS is to use the Play Store, as this is considered both the most secure and most convenient method for typical users, and to alternatively use the Aurora Store (a free and open-source software (FOSS) frontend to the Play Store) when anonymous access to the Play Store repository is desired. My guess is that this is the method employed by the vast majority of GOS users.
Many still opt to use Droid-ify or F-Droid as well, despite its potential security shortcomings. Many also prefer to download apps (APK files) directly from their respective developers when possible, and will often use an RSS feed reader (such as Read You) or a dedicated app tracker (such as Obtainium or the Android OSS Release Tracker) to track FOSS development and notify the user as updated versions of the apps are released. Finally, many will use a combination of all of the above.
As you can imagine, the above can get a bit complicated and tedious for users with basic security needs, so it is far easier to recommend the Play Store and/or the Aurora Store unless individual needs demand otherwise.
As has been mentioned here already, many apps that are available from Play Store do require at least some Google components in order to function correctly. Specifically, the Google Services Framework (GSF) is required by many apps for basic functionality.
GSF is a pretty benign Google component in terms of privacy implications and, in my experience it will work as intended without granting it any permissions whatsoever.
Aside from a few exceptions, push notifications and other Play-related app services generally require that Google Play Services be installed and granted network permission. Obviously, this can present a broader privacy concern, depending on your goals when choosing GrapheneOS.
For me, I choose to avoid Google Play Services and only use GSF (no permissions). I use the Aurora Store for Play-only apps, such as Google Camera, GBoard, etc. I use an RSS feed reader to track everything else, and whenever possible I download the individual apps directly from the developer's source code repositories (Github, Gitlab, etc.).
I do use Droid-ify as well, mostly as a search engine for finding new FOSS apps to test out; if/when I find a keeper, I reinstall the APK manually and add it to my RSS feed for future updates. Not all FOSS developers provide direct downloads from their repo, so in these cases I track the releases with my RSS feed reader as usual but then grab the APK from the F-Droid repo once it's available there.
Nearly all of the apps that I use are FOSS, and the only two apps that I rely on for push notifications (Signal and K9-Mail) are both capable of delivering these real-time notifications without the use of Google Play Services.
Hope this helps give you and others an idea of the app workflows that are possible.