There are 2 different aspects of accessing files on a share.
The share itself (which is like a door), and the files behind it, which is like the room.
By setting accessrights to the share itself, you only set permissions if a user can go through the door or not. In the past, this was the only way to set access to files on a network and for the sake of backwards compatibility, this was never removed.
For that reason, it is indeed common practice to give the Everyone group Full Control on the share itself.
When you then set access rights in the Security tab, you control access per file or per folder inside the share. For example, you can specify that a user can go through the door and reach the room behind it and the user only has permission to sit at table 2 and 3 (aka different folders controlled by either security groups or the user has permission set on the folder directly.
So if you give the Everyone group full control on the share, but you set NTFS security group rights, the user can still be denied.
If however you set the Everyone group in the security settings alongside with an NTFS security group, everyone has full control and the security group is ignored.