Tips on how to do it right the first time
Install Google Play Services on your main profile. Don't worry about secondary profiles.
The less you change, the better. This should be easy for you to follow if you value simplicity. GrapheneOS is already configured to work out of the box, especially for security.
DeletedUser443 Any tips such as not using a vpn for initial load? I read someone saying if you want to be private, maybe initially use an ip address like a library or public before loading sim card in?
This doesn't make sense and implies you don't understand what these ideas achieve. In my opinion, you don't need to worry about this. Just load your sim card in and setup the VPN you want.
But I also read someone was asked by Google for a phone number at some point to verify and there was a way to get it set up and then turn 2fa on or off so they won't ever need to request phone number (locked out etc) but I can't seem to locate thread
This likely won't be an issue if you just setup a new account when you install Google Play Services before setting up your VPN.
Is there a transfer like component where I can transfer my photos and all sorts
If it exists, I haven't seen it. Regardless, I would manually transfer because I prefer having full control.
I know sms messages are not secure however unfortunately and annoyingly so many companies use this service and I cannot get away from having sms but I have hated the fact that I was even forced to go from Samsung messages to Google messages.
Sounds to me like you're talking about RCS rather than SMS, since RCS specifically relies on Samsung and Google messages. GrapheneOS has a default SMS messaging app but does not officially support RCS.
Also I'm a little confused about profiles. Do I set up a main profile and then a secondary one for Google play store?
Don't worry about profiles.
Any other tips you can think of so I don't make a rookie error?
The less you change, the better.