I think the cheapest solution would be to buy a used simple phone that has NFC and still gets security updates, run it with Stock android and only use it for the payments.
So you have a clean solution for payments only and don't mix it with private things, and risks for malware should be low if you only use it for that and nothing else.
Those banking and payment apps always make problems with GrapheneOS.