Best way to set up permissions with nginx + php-fpm on shared hosting?

I prefer to use ACLs for this. For instance:

setfacl -R -m user:www-data:rx,d:user:www-data:rx /home

Gives the www-data user access to read files and traverse directories under /home, and applies the same ACL to any new files or directories created later.

Once applied, user home directories no longer have to be world-executable, (e.g. chmod o= /home/$USER) thus users can no longer read each other's files, but nginx can.

Note that if some directories need to be writable by the web server, you can set those up on a case by case basis by changing both instances of the permissions rx to rwx. For example:

setfacl -R -m user:www-data:rwx,d:user:www-data:rwx /home/user/public_html/wp-content/{cache,uploads}