I dont know much about Graphene / security, but you could install some apps in the workprofile.
You could use an crapp app there, if you need notifications from it. You would get these notifications, while you are in your normal profile. And the App couldnt access your Pictures for example. But with your File Manager you could copy Files to your Work Profile.