I'm a retired architect/admin/mcse/mct/IT Manager/etc. The "correct" way depends on the needs of the organization and these permissions are flexible on purpose. I'll share what worked for me and why, but I'll stop short of prescribing it for everyone as a best practice because a single standalone file server is different than a large domain with DFS and of course the needs and expectations of the organization using it.

First thing I believe is that setting up file shares is a one-time operation and if done correctly it's a 5 minute task and doesn't ever need to be touched again. All share and top level shared folder permissions are set using custom groups. I never use built-in groups (authenticated users, everyone, domain admins) for shares or permissions. In small installations this might never be an issue, but in my experience eventually a user, service account or something needs to be created that is part of one of the built in groups but should not have access to the share.

Once your shares and root permissions are set up correctly, all future granting and removing of access is putting users into groups, and removing users from groups. This can be easily delegated to service desk or junior admins without them needing to know NTFS or Share permissions. It's easy to look at a user and see what groups they are in (and determine what they have access to) and it's easy to look at a group and see what users have access.

I find that the fewer shared folders the better. Often it's easier to create one generic file share, and then create subfolders for different departments in the root folder. Often when a department requests a share they really just need their own folder with their own access on an existing share. Everyone uses the same unc path to get to the root and once there they only have access to what they need, and access based enumeration does a good job of making sure they see the stuff they have access to.

When creating a new share, I create one new group for user access. (xxx share access) xxx always matches the name of the share (\\server\xxx) Users get modify, never full control. I also usually already have a "share admins" group I've created which has full control, and in some casues a "share audit" group that has read only at the share level.

For the NTFS root folder of the share I disable permissions inheritance and then set appropriate NTFS permissions for the xxx share access group, admins, and audit/read only. I usually prefer admins to create and manage all the top level folders so the xxx share access group gets read only on the root folder and that permission is for the root folder only and doesn't get inherited.

xxx share access is a group that should never contain any users. Only groups. At this point the share is done and probably will never need to be looked at or touched again. Next is creating actual working folders in the root of the share.

Say the sales department needs a shared folder. Create a new folder in the root of the share called "Sales", create a new group called "Sales folder Access" and add the "Sales Folder Access" group to the "xxx share access" group. Set Sales folder Access Modify NTFS permissions to their folder.

In organizations with existing and managed "sales users" groups you can just add that group into the sales folder access group. Otherwise if you do things manually you tell the helpdesk about the "sales folder access" group and tell them to add any users that need access. Or you can delegate control and let the sales manager or whomever manage the membership of that group.

When future tickets come in for "new shares" just create a new folder instead.

You can easily use the groups to track or enforce quota if needed.

Another rule I like to enforce is that NTFS permissions on the Sales folder and everything created below are all the same. If someone needs a different set of permissions or users on a group of files then create a new top level folder for that. For example if sales managers wanted their own private folder I wouldn't create that under the sales folder, I'd create a new "Sales Manager Folder access" group and top level folder for them. It makes it much easier to reset NTFS permissions on a heirarchy of files if it gets messed up. It's also much easier from an auditing standpoint to be able to tell who whas access to specific things.

Clearly this isn't perfect, and it won't work for all needs, but it's worked very well in a number of organizations.