Intune - Best practices of deploying different configurations to devices

I'm fairly new to Intune and still getting used to how it works so apologies in advance for what may seem like a super simple question.

We're wanting to set up a slightly different deployment profile for our IT staff, one which installs different software than what a standard user would see, and has more permissions/less restrictions than that of a standard users device.

We also want to test deploying different applications to different as part of the initial ESP app install.

Currently we have 3 group tags, one for cloud, one for shared and one for hybrid devices. We also have 2 deployment profiles - one for cloud and one for shared devices. Would I be best creating a new deployment profile for what I'm trying to achieve, and assign specific users/groups to this?

Thanks in advance.

What is the best way of doing this?