In Microsoft SQL Server you have the possibility to set permissions at server and database level. You are also able to select a server login or database user and then set securables. I am wondering what choosing between these two strategies means from a security perspective. Does either permissions or securables have priority over the other?
In this article, a securable is defined as "resources that can be accessed by a principal", whereas permissions are defined as "Types of access granted on a securable to a specific principal". This sounds totally reasonable on paper. However, within Microsoft SQL Server Management Studio, I see that I can choose between "CustomDatabase -> Properties -> Permissions -> CustomUser" and "CustomDatabase -> Security -> Users -> CustomUser -> Properties -> Securables" when granting or denying a user the same action for the same database.
Let's say I would like a user to be able to read from all tables within a database. Should I grant the user SELECT permission in the database properties window or should I grant the user SELECT securable in the user properties window? What would be the difference in this case from choosing one over the other? Are there any other cases I should consider when choosing which user authorization strategy to pursue?
Any insight on this matter is highly appreciated, as I could not find any satisfying explanation anywhere else.