For firewall rules — when Firewall rules apply to groups of users…
interfaces are best for two or more whole subnets ( exception: management subnet may the only subnet in such an interface )
Dst or Src address are best to describe a single subnet
Firewall addresses are best for any situation requiring a large number of users in a subnet (but not the whole subnet), or a bunch of users across several subnets (with or without whole subnets).