Securing Microsoft Teams Best Practice & Cleanup

Working on a Teams environment that is fully wide open. They have seen a huge number of Teams created and are looking to get it under control from here on out and clean up. Wanted some advice on what you recommend doing and if you have the instructions to complete those tasks. My thoughts would be

Block Team creation where IT would need to be involved. I believe this could be accomplished by blocking M365 Group creation.

Way to expire or archive old Teams with no activity in X amount of time?

Also, how are you handling guest invitations or access? Doing anything that allows but might secure things better for the organization.

Thanks all.