Big fan of Graphene! The balance I personally prefer is to use Shelter to create a "work profile" and install Play Services in there along with any apps that must have Play Services. Then, I only enable the work profile when I need to use those apps.