SharePoint 2010 Managed Accounts

hello,

What are the best practices for assigning Managed Accounts, and setting the Farm Account?  Right now, we have a service account that starts all off the SP2010 services, and that account is the same account for the Farm.

My question is, does this account need all of those permissions?  I see that this account can log into the content site and access all content for a site collection, which I prefer that it not be able to.

Thanks,