There is no set number. Instead, access should be limited to the necessary staff that need access to these files, which is usually quite small. Like most things in WordPress, only gives users access to what they absolutely need.