SPO restricting accounts to specific site document folders

In terms of governance, best advice here is to create a Security Group in your Azure AD for this internal accounts, map it either to a SharePoint Group or a permission level and then break security inheritance in the folders you want to share with them...once you do that, add the SharePoint Group or the Security Group to security scope you have just created in those folders