The recommended practice is to start a project with setting up the following business roles and assigning them to individual users. Assigning user groups or user roles directly on the user should be avoided since it is a lot more difficult to maintain and keep overview for big group of users after GO LIVE.
These are the very typical roles that projects have:
System Admins (= “All Roles”) - for configuration engineers and System admin from the customer)
Price Analyst (for Price Builder) or Sales (for Quote Configurator) - the ones who initiate the price/discount change
Pricing Manager or Sales Manager - typically approve prices / discounts and have access to dashboards
This will help you test and fine tune the security from the very beginning and avoid cleaning permissions before UAT.