Start with business requirements, users, applications and traffic flows. Then build an architecture around segmentation, redundancy, controlled access and operational visibility.
Segmentation
Separate user, server, guest, voice, CCTV and management traffic where appropriate. Define who can communicate with whom and why.
Resilience
Use appropriate redundancy at critical layers and design for failure rather than assuming every component will always be available.
Operations
Document IP addressing, VLANs, routing, firewall policies, device roles and change procedures so the environment can be operated consistently.
This article is general technical guidance. Actual architecture should be validated against the organization's requirements, risk profile and existing infrastructure.