I eventually figured that out thankfully. Security by default is more work, but way more peace of mind this way. I heard they are also working on ad blocking, which will be nice
Discussion
check out
you get a 7 day trial w/o even signing up. it's free for 300,000 querries per month so i recommend using an alias email over vpn or tor to sign up.
once you get your link, on grapheneos:
1. Go to Settings → Network & internet → Private DNS.
2. Select the Private DNS provider hostname option.
3. Enter (yournumber).dns.nextdns.io and hit Save.