You are setting up file permissions on a Windows server.

Make three groups (one with low access, 1 moderate, and 1 high) and fit everyone into one of these groups.

Give users the minimal access required for their job, as this is more secure.

Give everyone access, as this makes administration simpler.

Block access to files until a user specifically requests any.