Oggyo GSF doesn't require permissions, nor battery exceptions. As far as I know, Play Services and Store both require network permission for notifications and other service deliveries to work correctly.
You'll probably be okay disallowing notifications from Play Services, as I think it just manages the background tasks of relaying messages, wake-up calls, and other services to the dependent apps.
I don't think there's an easy way to know (in advance) which apps support WebSockets for push notifications. Honestly though, I don't think there are many. Signal does obviously, and perhaps K-9 does too...it uses IMAP's IDLE protocol extension for push notifications and I don't know whether that itself is using WebSockets on the back-end. The easiest way is probably to test an app in a profile that does not have Play installed.