Well first, my principle is always, people that are logging in are all users. For Authentication, you only need one user model and one guard.
Once you know who someone is, you can then apply Authorization to determine what they are able to do.
So I would always have one users table, a permissions table and a roles table. Assuming user can then have multiple roles and multiple permissions then you will need pivot tables also.
At this point its best just to choose a package and follow the packages way of doing things