PopM25
Profiles are recommended to be used based on personas, not app or usage categories. They don't aid the app sandbox and do not add any security to it. They block IPC and package discovery across profiles, but otherwise the app sandbox is the same everywhere.
It is not more secure or inherently more private to install apps in a secondary user than it is to install them in Owner.
Your described setup is very complex and too over-engineered in my opinion.
This will likely only heavily increase friction and decrease user experience, while having no tangible benefit on privacy and none at all on security.
My strong recommendation for most people is to use Owner as the main profile. Install all your apps including sandboxed Play Services there. Don't disable any Play Services components, there is no reason to do so and this will likely break it.
You can then expand on this setup with profiles if you need additional personas (For example for Work) or want to specifically make use of their features (individually putting at rest, different unlock method, VPN slot, etc)
Don't use Aurora Store. Is is not recommended, has security issues and no privacy benefit over sandboxed Play Services. It does not avoid Google nor its tracking.
You should use the official Google Play Store with sandboxed Play Services, which is the most secure and private way to go about getting apps that come from the Play Store. Apps from the Play Store often bundle Google libraries, which can run on their own without Play Services, but can facilitate the same data collection as it. It gives Google the same access as Play Services would have and the mere presence of Play Services is not what makes a difference on privacy or data collection.
If you want to "avoid Google" you cannot use any apps that come from the Play Store at all, full stop. Even if you get them from third party apk sites (which is strongly discouraged and very dangerous), as long as they contain Google libraries you basically have Play Services installed anyways.
Play Services is confined to the regular app sandbox on GrapheneOS. It doesn't have any elevated privileges or system integration and can only access a very minimal set of data (just like any other app).
You can read more here:
https://grapheneos.org/features#sandboxed-google-play
Going into some details:
PopM25 varying opinions such as on Aurora Store yes/no, F-Droid yes/no etc
The official recommendation is to avoid those two. They have considerable security issues and Aurora Store has no privacy benefit.
The two officially recommended 3rd party app sources are Accrescent and the official Google Play Store, both available on the first party GOS App Store.
You should be getting all your apps from those.
If an app isn't available in those two stores, fallback to sideloading via Obtainium+AppVerifier as a last resort, but otherwise avoid it as sideloading is inherently dangerous and less secure than the two previously mentioned secure stores.
PopM25 This way I can push those apps into other profiles
I see no need for that.
PopM25 Or will simply disabling GP sufficient for basic security I DO NOT want GP or Google fishing for info.
This has nothing to do with security. Play Services is always confined to the regular app sandbox, but it is not a security risk. Google is not a threat actor and very good about security.
Play Services cannot "fish for data" any more than other regular apps.
Apps cannot access private data of other apps and can only communicate with other apps based on mutual consent. If they talk, all information must be voluntarily shared. It doesn't just allow an app to freely peek into the private data of the other app.
PopM25 OK is that overkill
Yes
PopM25 leaning to the IronFox
Firefox based browsers are not recommended and considerably less secure than Chromium based browsers, especially on mobile.
It is recommended that you only use Vanadium if possible on GrapheneOS.
PopM25 3rd profile banking, finance stuff to protect allll the $ I don't have haha
Again, a profile does not increase security. You don't need a profile for this and a profile will not protect your data more than the regular app sandbox does anyways, everywhere. The basic app sandbox already protects and confines apps.
Why should this only be done by profiles, and not always?
PopM25 Then , simply disable NOT delete GPlay
Don't do this, just keep it enabled. The amount of time it runs does not equate to the amount of data it can collect.
Also, you critically need unattended automatic updates from Play Store on your apps for baseline security, so that's another reason why it needs to stay enabled.
So to summarise:
You likely don't need such a complex profile setup. Profiles do not aid the app sandbox and are not a necessity for a secure or private setup. Their importance and necessity tends to be vastly overstated by online guides, videos and tutorials.
Complex setups will end up increasing friction, decreasing user experience (constant profile switching, less performance, etc) while not even having the expected, or any tangible, benefits.
Hence, the recommendation for most people is to daily-drive Owner as their main profile and put all their apps (including Play Services if needes) there.
Try to get all your apps from Accrescent and the official Google Play Store exclusively.
Don't use Firefox based browsers and stick to Vanadium.
If you prefer, you can create an anonymous Google account with no PII or phone number attached for usage with sandboxed Play Services.
To do this, create it from in-app on a non-suspicious IP, meaning no VPN or Tor. Otherwise you'll get flagged and be prompted for a phone number.
The usual recommendation is to create it from a public place that has free WiFi, like a library or cafe.
I recommend to add 2fa afterwards. Not only is it a good default security measure either way, but it may also decrease the potential of your account getting flagged afterwards.