Do I need a paid plugin to do this?

No. The five built-in roles handle permissions with no plugin at all, and the free version of White Label CMS covers the login screen, the dashboard panels and the admin menus. Paid tools add things like rebranded system emails and custom CSS.

What if a client insists on Administrator access?<br>

It is their site, so that is their decision. Explain what Administrator can reach, keep your own separate Administrator account so you never lose access, and put an activity logging plugin on the site, since an Administrator can change anything and you will want a record of what changed.

How often should I change my starting install?

Whenever the same question reaches you from a second client. A repeated question usually points at a menu that confuses people, a notice that should have been hidden, or a link missing from the welcome panel, and changing the base means the next site ships with the fix already in it.