For immutable parts of the repository (/apps, /libs), based on Adobe recommendation, use Repoinit.
Usually there is a few of really needed permissions, you can close those permissions
in a dedicated user group, that can be then used as composition in other final user groups.