Several SAP landscapes need consistent governance and separated production access. Which foundation is appropriate?

1. Apply governance only after production migration
2. Place every workload in one unrestricted resource group
3. An SAP landing zone with an intentional management hierarchy, network design, and policy controls
4. Let each VM define its own unrelated network and access model