About Authority
I might be biased but I think people make security a bigger problem than it must be. Especially in the beginning. Try to get your game working and find some audience.
While authoritative clients mean some extra work, authoritative servers just cause a different type of work.
If your servers are authoritative, then you better keep them up to date when you update any level. Maybe you even need to do a simpler version of your 3d assets to keep CPU-usage low. Expensive CPUs are usually a no-go for F2P or cheap indie games that don’t have subscriptions.
If you can live with “authoritative” clients or not depends on the game and your ambitions. If money is involved, you have a lower tolerance for issues than when the game is a hobby project.
You should start with basic sanity checks that run on all clients. Track the usual issues you will get: Speed hack, perfect hit ratio, etc. If some player is suspicious for more than one client in a short time, then kick that player.
You will need accounts soon after that. If you kick one player, that’s only half of the story, cause that user can simply join another game, right? So you need accounts and ways to pause those or ban them permanently.
Photon Cloud does not have accounts built-in but it has “Custom Authentication” and “Web Hooks”. These two pieces allow you to setup a web service which can modify the accounts and ban users.
About Physics
Photon Cloud does not do “Unity physics”. If that’s a big problem for you, you will have to pick another solution.
As said: Physics on the server will cost you and can cause other issues. Also, having it on the server is not a guarantee that lag is no issue at all. You usually still need some lag compensation.
Having 2 ships collide and push each other around physically-correct is a little challenge. All clients will simulate the situation locally but no matter how low the lag, both clients might move the other’s ship in another direction. They don’t have the same result automatcially.
Server side physics might help here. For the worst case of “some more lag” you will need to be able to reset the positions, despite the server being right.
I am not the best to give tips about how exactly you should implement your ships. I simply didn’t experiment with that a lot.
Try to look up lag hiding algorithms and experiment with your case. As it’s the core of your game, invest a little time.
Or: Let the ships pass each other. Just do collision detection for the shots. Let the shooting player decide if it’s a hit and the others can check if it makes sense or not at all.
Sorry for the long-ish post and that I can’t help with concrete examples.