The recommended practice is to start a project with a configuration business role and a customer business role and assign the business roles to the users (instead of assigning user roles individually).setting up the following business roles and assigning them to individual users. Assigning user groups or user roles directly on the user should be avoided since it is a lot more difficult to maintain and keep overview for big group of users after GO LIVE.
These are the very typical roles that projects have:
System Admins (= “All Roles”) - for configuration engineers and System admin from the customer)
Price Analyst (for Price Builder) or Sales (for Quote Configurator) - the ones who initiate the price/discount change
Pricing Manager or Sales Manager - typically approve prices / discounts and have access to dashboards
This will help you test and fine tune the security from the very beginning and avoid cleaning permissions before UAT.