What's the difference among RLS, permission, access settings?

Hi everyone, 

I'm a bit confused by the different "access control" settings in PBI and hoping to get some clarifications here.

For example I have a PBI desktop file is ready to pubish. 

• RLS: so firstly I create roles in the PBI desktop, then I publish to a workspace. 

Then I go to workspace, click "Security" next to dataset, and then I add people to each role that I created in desktop.  

My first question is, what people can see, in Workspace and App, till this step?

• Manage permissions: my second question is what does this do? 

• Permissions under "Update app" button: my next question is what does this one do?

• Access: theres is also "Access" button on the top right corner of the workspace where I can add people's email address and assign them to either of the four roles. What is the difference between "Access" and "Manage permission" and "Permission" under the update app?

If anyone please provide some clarifications and best practice of how to use these "access controls", that would be really appreciated. Thank you.