Best practices for security and distribution groups

In an AD/Exchange environment, what is the correct way to structure security and distribution groups? I know you want a hierarchy, with the user in a group associated with their work role, then compose higher level groups from the smaller groups. Over the years I have seen people maintain separate security and distribution groups, and not. What's the best way to keep this manageable?