What is the optimal way to group them in order to enforce security policies from NSX-T Data Center?

A company is deploying a NSX-T Data Center micro-segmentation in their vSphere environment to allow simple 3-tier app forms through web, app, and database.
The naming convention will be:
• WKS-WEB-SRV-XXX
• WKY-APP-SRR-XXX
• WKI-DB-SRR-XXX
What is the optimal way to group them in order to enforce security policies from NSX-T Data Center?
A. Use Edge as a firewall between tiers.
B. Create an Ethernet based security policy.
C. Do a service Insertion to accomplish the task.
D. Group all by means of tags membership.