What would the best practice to create/deploy all site columns, content types, lists need for the site while we do new project in Office 365 environment?

Hi

   Microsoft is saying use CAM App model wherever possible in SP 2013 Cloud environment.

When we are implementing a new project, what would be the best approach to create all site columns, lists, content types need for the site? Create an app to deploy all these? How to we handle user permissions, not app permissions on lists that created inside an app? I read some articles on permissions but is not clear, in SharePoint hosted app, where do I specify user permissions?

I see app manifest has some permissions options for lists but I don't see the lists created inside an app.

Thanks