The recommended practice is to start a project with the configuration business role and a customer business role and assign the business roles to the users instead of assigning user roles individually. It will help you to test and tune the security from the very beginning.
General
Content
Integrations
App links