User Account Best Practice - OCI, ERP, EPM - Cloud Console

Summary:

Best Practice for creation and maintenance of user accounts

Content (please ensure you mask any confidential information): 

Clients have new Cloud Console and there seem to provide functionality to create users.

• User accounts - EPM users, Fusion users and Console users - how are they linked and are they maintained from Console ?
• What is a lifecycle - where is a starting point, any synchnonization ?
• What is the 'best practice' from Oracle to maintain users ? 

I am asking this, because there is still Security Console in Fusion, where users can still be created and roles are granted.  

In my understanding, Fusion users can be created in Cloud Console and detailed roles can be provisioned in Security Console in Fusion. Similar for EPM ?