When to use each organization-wide default
Key Takeaway
Set each object's org-wide default to match the most restricted user, then use other sharing tools to open access for the people who need more.
Organization-wide defaults (org-wide defaults) set the starting access every user has to records they don't own, one object at a time. The right default for an object depends on what the most restricted user may see and edit.
Lock down first, then open up
The design rule is to lock down first, then open up. You set the default to the access the most restricted user should have. Then you use other sharing tools to give more access to specific users. In order of increasing access, these tools are the role hierarchy, sharing rules, and manual sharing.
These tools can only add access and never take it away, so none of them can restrict a user below the org-wide default.
For each object, you can set one default for internal users and a different one for external users. Setting a default requires the "Manage Sharing" permission.