Profiles versus permission sets for default settings and access
Key Takeaway
Put default settings in the profile, and put permissions and access settings in permission sets. Default record types, page layouts, login IP restrictions, and login hour restrictions must be set in a profile, so permission sets can't fully replace it.
Profiles and permission sets both control what users can see and do in Salesforce, but each has a different job. Every user gets exactly one profile. The profile should hold default settings, such as the default app, record types, page layouts, and login restrictions. A user can also have many permission sets. Permission sets should hold the actual permissions and access, such as object, field, and user permissions. When you provision users from a final design, this split decides how many profiles you build and what goes into each profile and permission set.
Permissions and access settings
Two kinds of control decide what a user can do. Permissions decide whether a user can access object records and do certain tasks, such as viewing the Setup menu, permanently deleting records in the Recycle Bin, or resetting a user's password. Access settings control other functions, such as access to Apex classes, app visibility, and the hours when users can log in. You can set both in profiles and in permission sets, so the real design question is where each one belongs.