Right security architecture for SQL Server access in a distributed Windows-based system

I am designing a software product for which multiple SQL Server databases will be accessed by multiple applications residing in different Windows environments. Some of the environments are process hosts that run scheduled jobs against the databases. Some of the environments serve as APIs for the data. In all cases, the applications access the databases via an ORM (Entity Framework).

As a software engineer I'm getting better at what I do. But as an infrastructure security engineer I've got a lot to learn. My current thinking is that I want to use Windows authentication only and forget about roles and logins at the database level. Further, I'm thinking to run scheduled jobs using the Local Service account and restrict access to the database servers by endpoint using the firewall. But I'm concerned that if I grant INSERT/UPDATE privilege to any Local Service account and somebody makes a firewall mistake in the future, I might be in big trouble.

Please help me. I'm in over my head. Thanks in advance :-D