The CapabilityStatement defines what your internal system capabilities are - i.e. what data elements can you actually receive and store or spit out. Typically, it's possible to comply with multiple profiles simultaneously - you just need to spit out all the data elements, codings, extensions, etc. required by anyone. Where this runs into trouble is where profiles improperly enforce maximums. It's super bad practice to say things like "Patient.name is 1..1". The correct approach is for a profile to say "Of all the Patient.names that exist, there must be exactly one that is marked as a legal name, does not have an end date (and possibly that has an extension declaring it as the 'U.S. legal name)". That approach means that a system can build a single interface that exposes the relevant data to everyone and consuming systems can use the data they care about. Otherwise, you're forced to create, maintain and expose different interfaces to different consumers which creates additional initial and ongoing costs.
It's possible for instances to declare conformance with multiple profiles, but the usual recommendation is to not declare profiles at all (as it's unlikely you'll ever declare all the profiles most consumers will care about). Instead, client applications will determine validity against what profiles they care about if/when they care to.