Not all built-in apps had that option but for everything else you can.

block them from accessing the Internet on non-GrapheneOS phones

This is an important feature in GrapheneOS. You can deny network access for any app.

Evolution is a Gnome software so you’ll probably need to install gnome-keyring.

I use session restore with my KDE and most windows end up back to the workspace they were. It’s somewhat annoying that not all go back to where they were but I’ve learned to live with it. May or may not have anything to do with kwin rules as I’ve not manually set anything.