Using Single Sign-On for Marketing Cloud, how are the Marketing Cloud roles managed? From Marketing Cloud as a standard user or from Sales Cloud? I've never implemented it and after reading the documentation this topic is still not clear for me.
You will manage the roles in MC. Users still need to be created in Marketing Cloud, and have roles and business units assigned. The advantage of SSO is, that they would not need to provide MC credentials when logging into MC.
You can select which users in SFMC would be applicable for SSO, as you still might have cases where some users (e.g. if you are working with an agency) don't have access to Sales Cloud - and will need to use regular authentication with user/password in MC.