Once you are confident that all the legitimate mail is aligned, then go straight to p=reject. Many will recommend quarantine, but it's better to have an email bounce back immediately vs silently get lost in a spam folder. Outside of troubleshooting there isn't much use for P=Quarantine in DMARC or '~all' in SPF.