DeletedGravy
First thing is to set up incremental offline backups. Your just starting to learn, your going to make mistakes and reinstall the os. Might as well make experimentation as painless as possible. https://support.system76.com/articles/backup-files/ Of course, also make at least 2 installers for the OS. The system 76 team is great and will help you. If you haven't seen it yet, they have a forum for pop-os too. https://chat.pop-os.org/landing#/login
Virtual machines are your friend. You can use them to compartmentalize for both security and organization, and to experiment. Look up boxes and virt-manager in the app store. Boxes is made to be beginner friendly, so you should start there. Theres lot of hypervisors (virtualization software). These are just two front ends to the best one.
You probably don't want to backup the virtual machines themselves, just the files you use. From there, learn how the system works. Vms can be re created and take up a lot of space on your backups. It only takes a few clicks to update and install whatever apps that vm needs. If you get into the command line, you can script and automate all that.
App Armor can be useful. And yes, its there from Ubuntu, and already on by default. Though its permissions can be pretty lax. With System76, its best to go with their recommendations on anything in the bios. Should be safe to turn off IME. You can turn it back on if need be.
Yes, you can ignore that stuff for now. You'll learn how to use them. If you want to look up apparmor, also look up ACLs and selinux. Like everything else, you can safely and freely experiment with them in virtual machines.
A phone running graphene-os more secure than any desktop not running qubes-os. (To anyone who wants to @ me, yes, this is a very general statement) A password manager (i recommend keepassdx) running on your phone is more secure than one running on your desktop. A keyboard plugged into your phone will help you type your long keepassdx passphrase. See xkcd/936 but note that they're talking time to access passwords that are rate limited by the server. You want 10 words (128 bits of entropy) for cryptographic passphrases like your keypass db. Conveniently, keypass can generate passphrases with as many words as you want. You'll probably want to write that down, encoded if you can deal with that, and then shred that paper when you've memorized it. Get used to memorizing long passphrases.