Authentication best practices depend on the whole infrastructure setup, the application's nature, the user's characteristics, data sensitivity, and so on. For example, the following setup is common for start-up companies: the database application, including the database server, is hosted on the same machine and only used from one physical location by intracompany users.
Often, database servers are isolated from the world using firewalls; in this case, one can use the scram-sha-256 authentication method and limit the IP addresses so that the database server accepts connections within a certain range or set. Note that it is important not to use a superuser or database owner account to connect to the database, because if this account were hacked, the whole database cluster would be exposed.
If the application server—business logic—and database server are not on the same machine, one can use a strong authentication method, such as LDAP (Lightweight Directory Access...