We use SharePoint extensively internally and support a number of clients that we put on to it (former SBS MVP here).
The permissions structure is similar to Group Policy or CSS where the shirt closest to your back wins permissions wise. Traverse is not something that we can do in SharePoint unlike other file permissions/shares setups. That's something to keep in mind when it comes to folder permissions structures.
We set up up dedicated subsites for our various needs.
We set up split DNS for the Internet FQDN internally and externally to make things simple for folks in and out of the office. But then, we host our own.
We set up WebDAV and use a shortcut \\sharepoint.domain.com@SSL@PORTID\DavWWWRoot for folks accessing externally. In the case of O365 the simple way to grab that UNC is to open in IE, use the Open in File Explorer option for a library, and pull the icon down from the address bar in File Explorer to Quick Access/Favourites. Right click the shortcut and Properties to get the UNC.
The simplest way to sell SP is to show folks the Check Out/In and Reviewer Approve/Disapprove and the Versions features. We enable mandatory check out/in and draft/final versioning on all libraries.
All users add Check Out/Check In/Server to their Office app's Quick Access Toolbar:

Having those three buttons up there eliminates most support calls as folks get used to checking them for a file's status.