Night DEV community!

This is a beginner's question and I'm really looking forward to learning from you now. 😄

Context:
I want to create a project to put in practice some skills that I just learned.
The idea: An APP with authentication and different views according to the user's role.

• Frot-end: React-native OR Flutter.
• Back-end: Express.js(Node.js) AND MongoDB.

Features:

• Users should be able to create an account/ sign in and sign out.
• There will be 2 types of users: NORMAL USER and STORE.
• Normal User = One e-mail and one password. Impossible to have two of the same. It will have access to some features on the app (CRUD operations).
• STORE = This user will have one e-mail and one password.It will have access to some features on the app (CRUD operations). The CATCH: this user will be able to create sub-users with the same access to the same features as the main STORE USER.

Questions:

1. I know how to authenticate using Express (JWT, Passport, Middlewares, etc). Is that a common/best practice for an app? Use the authentication on the endpoints/requests?
2. The relationship between a STORE user and it's sub-users would be one-to-few. So, should I have them referenced inside my schema or actually embed them inside the STORE schema?

Not sure if I was clear but I hope to get some insight before starting coding and figure out that I went the wrong way. 😌🤓

Thank you!