How to Compare Profiles

The support staff for our Salesforce installation (Lightning) moved on to different work, and while we pursue hiring of a replacement, we are somewhat in the dark about user profiles. I've read through the basic guidance on the user access structure, i.e. Profiles, Roles, Permission Sets. However, we have a task that requires complex understanding of user permissions that we just don't have yet. 

We have a directive from our CEO to move a handful of users out of a profile called "Exec-Team", and we lack any guidance on how to intelligently decide which profile to move these users

or whether to create new profiles.  

While the “Exec-Team” profile is by far our most populous, the bulk of

users are under one other sales-centered profile. The difficult fact is that we don’t know precisely what access these to-be-moved users would be gaining or losing. They serve a variety of roles under different departments. 

We want to be able to understand and fulfill business needs, while adhering to the least-privileged-access principal.  

We have a "standard" support level under our current contract, so have limited Salesforce support resources to draw from. Are we stuck with either waiting until we hire a Salesforce Admin expert, or else hiring an outside consultant? 

Thanks very much!