How to implement Basic hardening of linux?

archwiki on Sudo
archwiki on Users and Groups

I’m configuring a new install on my laptop, mainly to study system administration on linux. Previously I have used wheel-group to give my user sudo-permissions, used unencrypted filesystem, and never allowed ssh into my laptop (after all, it’s a laptop).

This time I however want to try configuring the system more securely, and implement features one would use in servers. However that definitely requires re-thinking how I set up access rights, sudo privileges and other default control groups.

I’m using arch linux, and I have one ext4 partition for root directory, and I intend to stick with systemd and sudo.

Any tips are welcome, as well as general recommendations. However I have few more specific questions:

Should I give the wheel group sudo privileges? If not, how does that play with PAM?

Should I create separate users admin and devel, as in the example in archwiki? Should I disable root account?

Should I implement an encryption layer over ext4, for sensitive directories?

Any links or opinions are welcome! Again, my aim is to learn, so I don’t care if implementing something is overkill for a laptop, as long as it can be implemented without changing kernel.