SAP Delivered roles in S/4HANA

Hi Guys

I am a security consultant but new to S/4HANA on-premise edition with NWBC

can anyone please suggest if there are any

--> lessons learnt while implementing security in the systems?

--> Approach to design end user roles?

--> Importance of NWBC and roles need to be assigned in specific to NWBC to end users

--> Any blog/documentation available in regards to security(roles and authorizations)?

Thanks for your time.