GrapheneOS is unmatched when it comes to security features including hardening. Don’t get me wrong calyx is great and when you like to use microG then it’s there. With graphene you can also install google play and framework (if you wish so) but in a different approach. It’s like a normal app. So you can do it with network access given or not even etc… it’s worth to test out also the profiles and separate your life into profiles… you can have on one google service on one not etc… and all getting push notifications. Most banking apps work (to be honest very had any issues.)
With calyx like I say it’s a privacy but not security hardened approach. And calyx been back in security updates what been pushed from google sometimes for months. For me it’s a clear choice but it’s your call…
The first thing to consider is what you want to archive. Security and privacy are not the same thing, however go hand in hand. With rooting you can go deeply into your systems setup, however it also opens potential threats against you. Adb is more secure. When it comes to privacy consider also rethinkdns or any other firewall. You can block internet access to specific apps and even system apps.