“Best Practices” is a term of corporate art, loosely equating to requests seeking to out-source thinking about one’s own particular situation, requirements, limitations, and advantages. Corporate posterior-covering is one of the more cynical translations.
Here? You’ll want to ponder about what you’re backing up, and why, and for how long. Is this for client system recovery? For document preservation? Legal data retention requirements? Other reasons?
Also ponder about how you can and will get rid of data you no longer want, or no longer need, or are no longer permitted to possess, or data that’s now increasingly risky to have around.
Time Machine targets? Start here: Backup disks you can use with Time Machine - Apple Support
iCloud is a sharing service, not a backup service.
Backup services including SpiderOak and BackBlaze might be interesting for off-site storage.
DAS is cheaper.
NAS works fine, but is more expensive.
Wi-Fi NAS means no cabling when a laptop arrives back on the Wi-Fi.
NAS means fewer disks on desks, when used with a team of folks.
More than one Time Machine archive reduces the exposure to corruptions.
Rotating backups reduces the exposure to intentional corruptions.
Whatever scheme is chosen, try and then document the restoration. You’re under less stress when testing, too.
Whatever scheme or service is chosen, encrypt all backups, all storage devices.