I did plan on using the fossify suite as well.

It works fine and everything sorts correctly once you’re using the app, it’s just an odd sorting quirk I noticed on install and SMS import.

how does one obtain a banking app without the play store?

I use the Aurora app store found on F-Droid. This is a private client for the Google Play Store. It allows you to download apps from Google Play without having to use or link a Google account. The app page on the Aurora store will also tell you if the app you’re looking at requires the Play Services and how successful running it without the services would be.

There is an argument that Aurora Store is vulnerable to malicious apps being downloaded instead of the proper app but I’ve used it for years and have never had an issue.

Or is there some way to fence off or sandbox things?

Graphene does sandbox Play Services but if you use an account to interact with Google, Google is going to have that data on you. I see a lot of people setting up different profiles to try to further isolate Google on their phone but IMHO, it’s just a lot of hassle for the perceived minimal benefit. I think everyone needs to decide whether they want to use Google services and if they do, simply use them. If not, I don’t think all of the hoops you jump through to try to sandbox the services are actually doing anything beneficial privacy-wise.

If you want to use Graphene but want to use Google Services and apps that rely on them, that’s completely doable, you can always reset down the road if you decide to stop using them. I will say that Graphene and Google services are not set and forget. You will likely spend a few days searching solutions on getting apps relying on Google to work properly since Graphene does try to isolate Google. Graphene is a fantastic and easy-to-use non-Google OS but requires a lot of legwork to use like a normal Google OS.