I've advocated for years that each program should be ran as its own user and group, isolated from the rest of the system. So let's say you run Firefox, is should run as firefox_username user and group. This way any exploit is ran with the user/group permissions, and unexploited it has no read write access outside its own user and group.

Selinux is a beast but there are tools to help with determining which settings need to be applied.

If you desire a truly locked down system, where you have a person or can afford a person dedicated to its security it's a good tool. Otherwise just turn it off.

How likely is it your server is going to be actively attacked? Usually very unlikely. We don't count the random and always present background brute force attempts, they're just background noise.