I agree that graphene is the easiest. Because you can install the Google subsystem in the work profile, everything will just work there no problems. It's very clear what you're doing, and what has access to what.
Because when you start graphing you have nothing on your phone, everything you install becomes a deliberate choice. So it's very very very simple, oh I need a web browser I'm going to choose a web browser etc.