ACLs are super simple and work well, just dig into them. I use groups as rbac (one group per role), and share parts of my network with friends/family (game servers), and colleagues (work collab stuff, such as live coding).

Toggling users on/off also works great, and disabled users don't count towards the limit.

I use tags. For example, anything with a server tag can accept ingress ssh connections but not egress.