Could I ask you gurus how it's really done with setting firewall ports and security?

I'm sorry if this is too junior for this sub, but I always wanted to ask the big guys:

Let's say you are setting up a firewall inside an office with x amount of clients and servers.

Question: Do you close all ports and open them one by one as they are needed, and how do you find out which are needed?

Obviously there is some list of standard ports; 443, 80, 8080, 53, and so on. But having set up smalscale home and small office router/firewalls, one kind of just enable the "firewall" function, and feel that you are somewhat safer. I understand that the main job of a firewall is to figure out if the incoming port was asked by someone on the inside to begin with, but how do you big guys do it?