Honestly I’m not technically knowledgeable enough to answer, you can have a read of their FAQs. But my understanding is that the sandbox allows some google services to be used, but without privileged access to the rest of the system. As opposed to blocking them entirely, which would mean you couldn’t use those services at all. https://grapheneos.org/usage#sandboxed-google-play
Shameless plug for my own GBC game, it’s very kid friendly https://blue-dog-games.itch.io/bouncy-bouncy