Explanation
Public Read Only is the best organization-wide default configuration to fulfill the requirements. Public Read Only means that all users can view all records, but only the owners and those above them in the role hierarchy can edit them3. This matches the requirements for sales users and sales managers. For service users, a record type-based sharing rule can be created to restrict their access to accounts with a RecordType of Prospect.
Public Read Write, Private, and Public Read/Transfer are not suitable configurations for the requirements.

Explanation
Account records can be accessed due to implicit sharing from Opportunity and Account records can be accessed due to role hierarchy are two reasons that could be causing this issue. Implicit sharing grants access to parent records when a user has access to a child record. For example, if a user has access to an opportunity, they also have access to its related account and contract records. Role hierarchy grants access to records owned by or shared with users who are below in the hierarchy. For example, if a user is above another user in the role hierarchy, they can access any records that the lower user can access. Option A is incorrect, since contact records cannot be accessed due to implicit sharing from account, as implicit sharing does not grant access to child records. Option C is incorrect, since contact records cannot be accessed due to implicit sharing from opportunity, as implicit sharing does not grant access to child records.