configure spanning-tree loopguard, root guard, bpdu guard on Cisco switches

I'm learning to configure spanning-tree guard loop, guard root, bpdu guard, etc. Some best practices guide on the web and cisco site said that spanning-tree loopguard default should be configured globally for the entire switched network, other guide said that spanning-tree loop guard should be applied at blocking ports only. I am not sure whether to configure it globally or at blocking ports? What are best practices to configure these spanning-tree security features without shutdown the ports ? please advise. thanks