To filter records entering a journey based on an updated status field ("shipped"), the marketer should use:
* An Entry Source Filter to limit which contacts actually enter the journey at the point of entry (e.g., only those whose order status is 'shipped' today).
* An SQL Query to preprocess or segment records within a Data Extension before injecting them into the journey.
Filter Activity is used inside Automation Studio (not at the journey entry point), and Decision Splits occur after entry - not before.
-
Exact Extracts from Salesforce Documentation:
Source: Salesforce Help - Entry Source Filters
# "An entry source filter defines criteria that records must meet before entering a journey." Source: Salesforce Help - SQL Query Activities
# "Use SQL Query Activities to select, transform, and filter data from one or more data extensions."
-

The best practice is to have one Parent BU (NTO) and three separate Child BUs (Universal Containers, Ursa Major Solar, and Cloud Kicks) - each with its own Sender Authentication Package (SAP) for branding, authentication, and independent sending reputation.
This structure provides clear separation of assets, subscribers, and branding while allowing NTO to retain access for reporting and oversight at the Parent BU level.
-
Exact Extracts from Salesforce Documentation:
Source: Salesforce Help - Business Unit Hierarchies
# "Use a Parent BU to manage settings and aggregate reporting across Child BUs. Assign separate Sender Authentication Packages to each Child BU for independent branding and deliverability." Source: Salesforce Implementation Guide - Business Unit Structure
# "A scalable hierarchy should provide isolation for brand-specific assets and subscribers while maintaining corporate oversight."

The installed package must include the proper OAuth Scopes (specifically Read and Write permissions) for Data Extensions. Without these permissions, the API cannot upsert (insert/update) data into DEs. Also, client ID and secret must be kept server-side for security reasons (thus eliminating C).
-
Exact Extract from Salesforce Documentation:
Source: Salesforce Help - Installed Packages Permissions
# "When creating an installed package for API integrations, you must ensure that the package has the appropriate scopes. To upsert rows into data extensions, grant both Read and Write permissions for Data Extensions." Source: Salesforce Developer Documentation - Security Best Practices
# "Never expose client IDs and secrets in client-side code such as JavaScript. These credentials must be kept secure on server-side systems."
-

Explanation
How many API calls are expected to be made at peak hourly rate? This question will help determine if they have enough API limits and bandwidth for importing large volumes of data via REST API into Marketing Cloud. The REST API has limits on how many requests can be made per hour per account based on license type and edition.
Why do they require 10 years'historical data in Marketing Cloud? This question will help determine if they have a valid business case and use case for importing large volumes of historical data into Marketing Cloud. Depending on their marketing objectives and strategies, they may notneed 10 years' historical data in Marketing Cloud, which could reduce their storage needs and costs.
What time of day are the API calls made is not relevant to determining a solution for importing large volumes of data via REST API into Marketing Cloud, asit does not affect how data is imported or processed. Whether someone needs to be notified if an error happens on import is not relevant to determining a solution for importing large volumes of data via REST API into Marketing Cloud, as it does not affecthow data is imported or processed. References:
https://help.salesforce.com/s/articleView?id=sf.mc_overview_large_data_extensions.htm&type=5
https://developer.salesforce.com/docs/atlas.en-us.noversion.mc-apis.meta/mc-apis/using_the_rest_api.htm