MongoDB Atlas Security (and IP Address range?)

What is the best way to ensure MongoDB Atlas security and access control? (for Node.js / Golang)

There are too many choices.

API key

Database users

• Password
• Certificate
• AWS IAM

About IP Addresses

What should be the IP address range? How often do YOU had to assign new IP address permission?

I believe it is not only about Mongo, but anything 12-factor'd.

How does it apply to Heroku?

And, WHY IP address, not MAC address, for development machines?