Best Practices for Permissions on an O365 Group SharePoint Site

So it seems that you can break permissions of individual lists/libraries/items, but you can't actually set permissions on the site as a whole?  Am I missing something when looking at configuring gene...