black GOS will actually ask you after the setup if it should turn off OEM unlock automatically, without you having to do it manually. Yes, turning it off, including keeping dev options disabled is recommended.
So yea, the correct setup is: Flashing GOS, locked bootloader, OEM unlock off, dev options off. Just use the phone like a normal phone without modifications.