I believe spam detection in the Google Phone app does work on GrapheneOS.

For spam, install their sandboxed Google Play, and then install Google's Phone and Speech Recognition & Synthesis apps. For SMS/MMS/RCS spam, you'd use an app supporting blocking (e.g., Google Messages).

I imagine that Hold For Me works if you also install the Google app and whatever other dependencies.