Bitlocker deployment with Intune

Hello guys,
I have a question about different ways to deploy bitlocker, MD ATP....in my admin console under endpoint security, there are new options, Av, bitlocker....I'm really confused about which approach to use. Should i creat a policy under endpoints security for bitlocker, or device configuration or security base line ?! Please help before my beard becomes all white. An other question about assignment, do you put users or devices in groups to which you deploy different policies? Thanks in advance