Best practice on ASM policy deployment advices (automatic, manual)?

The automatic policy builder runs in the background and develops your policy based on the traffic it sees. So, for instance, if it sees a large number of requests for .jpgs it's likely to conclude that jpgs are okay files and add a rule to the whitelist allowing that. Manual deployment may start from the same place but after you deploy it's done. Any changes you need to make must be made manually.

If you have a lot of generally clean traffic, or are willing to go back and fix it's mistakes, Automatic Policy Builder is fine. If your traffic is less trustworthy or you want to have total control over what you are doing with your ASM, Manual is the better way to go.

In either case you should be in regular communication with the admin in charge of the web application to ensure that your policy matches the needs of the application, and you should ensure that you are regularly reviewing the policy changes, learning suggestions, and proxy logs.