There's certainly not a necessity to use Google Play Services in a separate use profile. As you're moving from iOS, I'd recommend starting off simple with everything in the owner profile. If you decide to later, you can always start moving apps to a separate user profile, to keep them separate if you wish to.
As you say, Google Play Services are sandboxed like other apps on GrapheneOS. So anything that Google Play Services can do, any other app can also do. It doesn't get any special treatment. I'd argue that's already a big step in privacy compared to iOS or stock Android.