Server, Cloud and Public
Tableau Server is self-hosted; Tableau Cloud is the hosted equivalent. Both let people view and interact with published workbooks in a browser, with editing available but more limited than Desktop.
Tableau Public is free and public — anything you publish there is visible to anyone. Never use it for internal data. Tableau Reader is a free desktop app that opens .twbx files locally without a Server licence.
Embedded vs. published data sources
When you publish a workbook, its data source can be embedded — travelling with that one workbook — or published separately as its own object on the Server.
A published data source can be reused by many workbooks, keeps its calculations and formatting in one place, and means a schema change is fixed once rather than in twelve workbooks. If more than one workbook will use the same data, publish the data source separately. It's the single best habit for keeping a Tableau deployment maintainable.
Permissions
Permissions are set on projects, workbooks, views and data sources, and granted to users or groups. Each capability is Allowed, Denied, or unspecified.
Denied wins. A deny on any applicable rule beats an allow anywhere else, and it cannot be overridden further down. Manage permissions on groups at the project level and let contents inherit — per-user permissions on individual workbooks become unmaintainable quickly.
A locked project enforces its permissions on everything inside and prevents per-workbook overrides.
Schedules and subscriptions
Extract refreshes run on schedules you attach to the extract. Full or incremental, at whatever cadence the data warrants.
Subscriptions email a snapshot of a view on a schedule. Data-driven alerts email only when a value crosses a threshold you set, which is usually more useful than a daily email nobody reads.
For automation outside the UI, tabcmd and the REST API both handle publishing and refresh triggers.