ACL for office network any tips for common rulesets

Hey all

I'm just setting up some proper ACLs and I'm just wondering how granular I should get. I can get very detailed and only open up certain ports on certain ranges but is that needed or should I just block inter desktop traffic and the common ones like RDP ssh etc.

What do you guys think for a windows desktop and server environment with phones and around 200 users.