The best way to think about it is to start with the protection of the end-user device, then work on protecting the access from that device to your external network, internal network etc and finally protection of 3rd party services you use as a company.
For the end-user device the important things are probably a secure password manager, full disk encryption, local firewall, antivirus, requiring a password to log in and locking the screen when you leave the machine.
We then move on to access to your external network (i.e. the user facing portion of your service which probably includes admin only tools). A good way to protect this is by requiring strong password + two factor authentication + access from a whitelisted range of IPs. The whitelisted range of IPs is either your VPN network or your network of ssh server hosts used as SOCKS proxy hosts.
To protect your internal network I think the best practice is to require all access to be via a limited set of bastion hosts again either over your VPN or over SSH.
Finally for all 3rd party services you should were possible require two factor auth be enabled and also educate your users on best practices around password strength etc.
Once you have all this setup the next layer is automated / human monitoring. This becomes easier if you require all elevated privilege access to happen via ssh socks proxies and bastion hosts because you can just implement monitoring of new /failed logins to those. You can the setup manual and automated rules to block users. For example, N failed logins block the source IP, login for an unexpected country manually disable the users public key until you verify it was them etc.
Overall the key idea is to help your users stay secure while still making it convenient for them to do there work.