How it’s set up depends on your business needs. We have a few hundred, and ow they’re set up and managed is defined by a dozen or so groups. Base image to deploy, then ansible and config management to set up the roles.
Users are generally authorised via AD using sssd. Some have very specific Groups which have normal user access and occasionally sudo privs for specific commands. SSH, RDP or physical access.
Our sysadmins have local users with root privs, but most administration is done at scale using ansible or Uyuni.
Like everything, least privilege is the best way. AD allows us to quickly control access if someone leaves or is compromised, but it could equally be done with any central LDAP system and groups.