And fully disable the USB port (GrapheneOS-exclusive feature). This will make it impossible to extract data with mobile forensics software/devices (such as the Cellebrite UFED).

Grapheneos has pin+biometric second factor as secondary unlock so it should be fine if you use that.