ardishco GrapheneOS will not integrate MicroG in the OS like other OSes do. As @f13a-6c3a mentioned, one can install MicroG on GrapheneOS (although there's no reason to do so), but as a regular app, it won't have most of its functionality intact.
Sandboxed Google Play, in my eyes, essentially obsoletes the MicroG approach with something much better.
Even with the privileged access that it has when it's installed in other OSes directly, Sandboxed Google Play is the superior option (doesn't require giving anything privileged access, and has far better app compatibility).
You don't have to use Sandboxed Google Play in a separate user profile. It is true that you can choose which profiles have Play Services installed with this method cause it's not a privileged component that has access to all profiles, but rather regular sandboxed apps just like any other apps you installed.
I recommend reading more about Sandboxed Google Play to understand it as a feature:
Edit: Just to elaborate on this -
and that would not be great with google services running in the background.
It is important to realize that with Sandboxed Google Play, it's not a special sandbox made by GrapheneOS that these apps are contained in. it's the regular app sandbox that all regular apps are contained by. Play Services will not have more access to your data than any other app you install. You get to control what they can access via permissions etc.
If you have any further questions, just let us know.