You can installed Google Play Services if you choose, and it'll run sandboxed (i.e. like any other app). I personally don't use Google Play at all on my main profile, and I have a dedicated profile for when I do need it.
That said, some apps just won't work regardless, like some banking apps (it'll fail the bootloader check). But everything I need works, and I have mostly replaced the Google-specific apps w/ alternatives (e.g. Organic Maps instead of Google Maps). My car isn't new enough to support Android Auto, so I have no experience with any limitations there.
Apps already run in a sandbox in regular Android, and GrapheneOS gives you a few more options (e.g. storage scopes and whatnot). What GrapheneOS does differently is force Google Play Services to also run in that same sandbox, so it behaves like a regular app instead of a privileged system service.