How do most orgs cope with SELinux?

SELinux is the default Linux Security Module (LSM) framework for RHEL, Fedora and openSUSE. So, many orgs have no choice but to use it for mandatory access control (MAC). From my research, I've come across many complaints about it. Poor documentation & usability are the two main issues I see most users complain about. Turning it off or using it in permissive mode (logging only) are common workarounds used to make it work smoothly. How does your org deal with it?

SELinux is useful in shrinking the attack surface and reducing the severity of some exploits. But if it requires grinding at it for years to get proficient enough, then most users will not be able to take full advantage of its capabilities.

I don't know much about AppArmor but this article claims SELinux is more robust but at the cost of increased complexity.