Using AAD and preventing access to specific pages

I'm making a technical documentation site (which uses [mkdocs](https://github.com/mkdocs/mkdocs)) that I've successfully deployed to SWA. My goal now is to:

1. ⛔ Completely restrict anonymous access
2. ✋ Only allow specific users within our Azure tenant to log on
3. 📂 Prevent specific users of seeing certain subfolders

To make things simple, consider the example below which represents the markdown content (which gets rendered to HTML):

```text
.
├── index.md
├── fruits
│ ├── apples.md
│ └── ...
├── veggies
│ ├── tomatoes.md
│ └── ...
└── ...
```

### 1. ⛔ Completely restrict anonymous access

I'm blocking all built-in providers, except for AAD. Is the below snippet sufficient? Or do I also need to set up an app registration as is mentioned in the docs, under [Custom authentication](https://docs.microsoft.com/en-us/azure/static-web-apps/authentication-custom?tabs=aad#azure-active-directory-version-2)?

```json
...
{
"route": "/login",
"serve": "/.auth/login/aad"
},
{
"route": "/.auth/login/apple",
"statusCode": 404
},
{
"route": "/.auth/login/facebook",
"statusCode": 404
},
{
"route": "/.auth/login/github",
"statusCode": 404
},
{
"route": "/.auth/login/google",
"statusCode": 404
},
{
"route": "/.auth/login/twitter",
"statusCode": 404
},
...
```
### 2. ✋ Only allow specific users within our Azure tenant to log on

Let's say I have 2 roles which I have set up under Settings > Role management in the portal. I've invited the necessary users and have assigned them one of the following roles:
- `roleX`: able to see all pages
- `roleY`: users in this role absolutely hate their veggies and should _not_ be able to see any content under `/veggies/*` (see 3.)

I don't need to do anything with the built-in `authenticated` or `anonymous` roles, right?

### 3. 📂 Prevent specific users of seeing certain subfolders

Would the below snippet be sufficient to get this to work?

```json
...
{
"route": "/*",
"serve": "/index.html",
"allowedRoles": [
"roleX",
"roleY"
]
},
{
"route": "/fruits/*",
"allowedRoles": [
"roleX",
"roleY"
]
},
{
"route": "/veggies/*",
"allowedRoles": [
"roleX"
]
}
...
```

If I would create more custom roles in the future, can I use the built-in `authenticated` role which would match automatically match any custom role I've created?

Thanks!