Grapheneos or calyxos

Honestly: try both! Install them on your phone have fun. They have their pluses and minuses. I think graphene gives you a cleaner more pure experience, and calyx gives you a more curated ready to go experience.

Things I like in calyex that aren't on graphene: being able to share your hotspot VPN connection. On a graphene phone you share the raw internet even if you have a VPN running.

But I very much appreciate graphene being crystal clean. And I can choose exactly what I want to run. Fairly easily. Full disclosure I'd donate to the graphene project monthly. So I may be biased because that's where I've invested my time and money.

they're both good. I don't think you'll be disappointed with either

I never tried calyx, but graphene is great for me. As to your two comments:

1. Graphene has network acess as a standard permission, so you can just deny network access by not giving permission
2. Yes, graphene intentionally does not ship with anything but barebones apps so you can install the ones you like. I like this approach a lot more than having bloatware I don't want pre-installed but it is a matter of preference

My last Pixel had Calyx installed and I used it for years. I'm on Graphene with my new Pixel as of early June. While there's no firewall app for Graphene, I get prompted to allow or deny network access for every app I install and can easily revoke access on any apps that are currently installed. I feel like I have a lot more control over the app permissions. I also have the Play Store and am able to use it. Google Play is sandboxed in Graphene. I highly recommend it.

If you want more in depth control on google services, CalyxOS supports microg in various combos (https://calyxos.org/docs/guide/microg/#options-for-running-microg-in-calyxos). While it has some limitations compared to the official google services, it also allows better privacy control and is fully open source.

I use CalyxOS because I want to be able to use Playstore app if I need to.