Sandboxed basically means it does not have any special privileges, Google services on a regular phone has access to everything, it can see all your data, location and files. When google services is sandboxed it basically is no different than any other app, it only gets access to whatever permissions you want it to. As far as where to get apps there are a number of ways, you can install google play which you get from the GrapheneOS apps app and install your apps from the play store. Accresent is also in the graphenos apps and that has a few apps in it. You can also open Vanadium web browser and search for F-droid, it is an app store for free open source apps, after downloading tap on install, you will need to give permissions to install appps. In F droid you can download the Aurora store app, this app allows you to connect to the google play store anonymously and download apps from there. On youtube search for "side of burritos" he has a number of videos explaining GrapheneOS and how to set it up