"Mirror" is there as GrapheneOS is hosting the Google apps for you to download, so you aren't going on a sketchy web site to download it. Also updates them for you! Make sure to get all the play services if you plan to use the Play Store, all three are important.

Sandboxing is a security mechanism for apps, it means that an app is isolated from each other and from most of the OS to minimize damage or malicious behaviour. Every user installed app is sandboxed on Android, that's why you need to allow an app to have permission to do something like use your camera, see your files and whatnot. Google Play is privileged and inbuilt into the OS in stock Android, but on GrapheneOS it is sandboxed like all the other apps are.