There are different topics here.
WITH SECURITY_ENFORCED. This a good keyword to use, but it is not required that you use it for the security review.
Security Review of internal apps. The issue with the review is that you avoid SOQL Injection and that your app performs secure access control logic. Good access control means that you respect the organization's security policy for objects that you do not own. There are no exceptions to this. But for fields that you do own, that is, custom fields, you have an opportunity to describe your business logic when you go through the review, and then that is what you need to enforce in your apex code.
- For security review of external apps, that is, experience or VF sites, you often must override standard policies and run without sharing as many of these fields' access policies are off by default and it would be a risk to enable them for external users.
When it comes to access control enforcement there are a number of tools to help you if you just want to respect the organization's policies. For example, with sharing, stripInaccessible, and SECURITY_ENFORCED are tools to help you. When you deviate from that path because you have more complex business logic to enforce on your custom fields, then you are allowed to do that but the app is put under more scrutiny and you are on your own to roll your own access control logic, which is generally discouraged but occasionally required. Please only do this if you are an expert. However you should still be able to pass the review with custom logic. If you want more detailed assistance, then book an office hour to go over this.