Here’s a great way to think about it, quoted from around the web:
Sharing only opens the door, security lets you in the door.
Standard practice is to allow everyone on sharing, and restrict access with security permissions. This keeps management simple as the most restrictive permissions apply between the two.