We've been slowly building guidelines by trial and error. We are using workflows in Windchill for approving different objects within each Product/Library. As such, the most defining feature for when you need a new Product/Library is when you need to have a different set of approvers.
In general, our Libraries house information that is general-use (not specific to a single product). These are mostly read-only to all users, with select people who can add content.
Users must request access and get approval to have access to a Product. Secret Products wouldn't be listed, and only authorized users can view/edit them.