How to do authoritative correctly

I'm very new to this, but after some research i've decided my project should use an authoritative server. I've seperated the project into 2 different projects, the dedicated server and client.

My goal here is to make the multiplayer watertight, and I want as much server code on the server as possible(This means avoiding overuse of Command. I have many questions here so bear with me.

1) Would I send the position directly to the server and have it verified? Or is NetworkTransform sufficient enough and I only need to add in Server Reconciliation + Prediction?

2) Is [Command] tamperable by the client? If it is, is it a bad idea to put the code for verifying movement there?

3) Is there any way to send a message directly from the client to the server(Without the use of RPC's or command)?

Thank you to all who help!