General help

This is one of those things that varies based on User requirements, student need, privacy obligations and other connected states. Best bet is to experiment on your test site. Try different combinations of permissions to make something work first then apply it to your production site when it meets your need. If you don't have a test site, then make one on a desktop or laptop that is not connected to your production site. Populate it with dummy students, teachers, managers, so that it reflects your production site but does not duplicate it. I have five Categories with one, two or three courses, depending, in each. I have about 20 users now, different Roles in different categories with one Category has one teacher and all others are Students on the only course in that Category. For this, that is the one I would use for testing. All Users have their password based on their name, Adam is Adam1, Beryl is Beryl1 and so on. This works for me and has built up over a decade, complete with upgrades as my production sites are upgraded after I test upgrades on my test site. Believe me, this had made things a lot easier and helped me avoid major mistakes before doing anything to my production sites. (Side benefit is this makes me look good when things happen without any incident or down time, the people who pay me smile at me, a real bonus. )

In the course settings is the gradebook set to be hidden from students? (this would trump the permissions)