I know that grapheneos has additional security measures compared to calyx, but does it include a similar app to datura firewall, which controls what apps are allowed network access, and I also like some of calyxos’ other features like including aurora store and the panic button, grapheneos feels very barebones, but I have not used either of them yet, so I don’t think I can make a definitive decision
If you want more in depth control on google services, CalyxOS supports microg in various combos (https://calyxos.org/docs/guide/microg/#options-for-running-microg-in-calyxos). While it has some limitations compared to the official google services, it also allows better privacy control and is fully open source.