GrapheneOS - User Profile and Google Services Setup

I ‘think’ I’m starting to understand how Shelter works better? Here is what my understanding is - would appreciate some feedback if I’m on the correct path.

  • I can basically consider the ‘work’ profile created by shelter as the same thing as a separate user profile - it is just much easier to swap back and forth…
    • so where I currently have 3 user profiles (Owner with no ‘play stuff’, user1 w/play-stuff but no google signins (e.g.: maps, voice), user2 w/play stuff but used for logging in to google apps). Also owner has apps w/o signing into things, user2 has apps w/signin (e.g.: financial/bank apps), user 3 has full google signing for google based apps.

With Shelter I can have: owner (as is currently) - and then user 1 with a work profile whereas I setup work to be my google signin - otherwise - just like my current user 3 ?

My main question though - is can I install the grapheneos sandboxed google services ONLY in the work profile? Or - do I HAVE to install the sandboxed services in both the main and work profiles?