How to globally enable/disable settings and features for all sites within the tenant?

I would like to globally set certain settings and features for all/a subset of Sharepoint sites within a given tenant.

Examples:

1. Activate certain site features for users in a given group/all users in the tenant for their ODfB
2. Give 'Data Governors' security group access to all sharepoint online sites (ODfB, Private, Teams and Groups)
3. Set versioning settings of all current and future libraries

These settings should apply to current and future sites that fall in the criteria (either all or a security group).

How can this be done?

Thanks,