In terms of best practice I like to parameterize variables that I know tie my package or project to a particular environment. Things like connection strings, file paths and user accounts are obvious candidates. By doing that you don't have to modify the package(s) itself when promoting to various environments. You're just configuring the environment variables with their correct values.

You're able to pass in a username and password variable when configuring the connection strings and you can also mark the password as sensitive to prevent it from being displayed.

With regards to your error when running the package, you'd have to provide your error message as this could be a number of things. I also like to use a proxy account and grant only the necessary permissions required to run the SSIS package.