An alternative (and possibly easier) way that doesn't require root is to use Hail + Shizuku.

Shizuku helps normal apps to use system APIs without root. You can enable it with from a computer with adb or from the phone itself using wireless debugging. Hail uses Shizuku's API access and lets you select apps to freeze. You can then unfreeze / refreeze apps with a quick tap in Hail.

If you already have root, all this becomes easier. If you do the wireless debugging method, Shizuku's API access won't survive a reboot. You'll have to go thru the wireless debugging procedure again before you can use Hail. https://shizuku.rikka.app/guide/setup/

This all has little to do with the privacy and security features provided by GrapheneOS. See https://news.ycombinator.com/item?id=45244497 in response to the original post with complaints about Android user profiles, which are not a GrapheneOS feature. Nearly the entirety of the GrapheneOS added features can be used without ever making/using a secondary user. It's not required by sandboxed Google Play at all. Secondary users are useful but not a feature added by GrapheneOS.