I'm currently readjusting the permissions strategy in my main Cumulus catalog and it's best put as "hurry up and wait!". As I write this I have a scheduler action applying a permissions template for several of my user groups to about 100K records of my more than 350K total in my catalog... it's slow going. Actually, come to think of it, most of my days are spent waiting for progress bars to complete in Cumulus. sigh.
I know the reward will be worth it in the end, after all saying good-bye to Live Filtering on a catalog level is very cool. I can't wait for users to stop complaining about how long it takes to log into WebClient or Sites due to the complex live filters processed at login.
As with anything however, there are some downsides to going LiveFilter free. There's just no method to search for what permission has been applied to a record or category. (that alone will be a blog post, I promise.) That means I have to come up with all sorts of crazy work around. All of which make my DAM soul sad.