I know that grapheneos has additional security measures compared to calyx, but does it include a similar app to datura firewall, which controls what apps are allowed network access, and I also like some of calyxos' other features like including aurora store and the panic button, grapheneos feels very barebones, but I have not used either of them yet, so I don't think I can make a definitive decision
My last Pixel had Calyx installed and I used it for years. I'm on Graphene with my new Pixel as of early June.
While there's no firewall app for Graphene, I get prompted to allow or deny network access for every app I install and can easily revoke access on any apps that are currently installed. I feel like I have a lot more control over the app permissions.
I also have the Play Store and am able to use it. Google Play is sandboxed in Graphene.
I highly recommend it.
Yes, unfortunately you need to log into Google Play to use the Play Store. But if you didn't want to do that, you can always install Aurora. I just removed Aurora though recently because I kept getting rate limited and it was basically useless for me.