I will try to answer your questions individually.

• Since we're not yet on the latest GRC version with Composite Entities. What should be the way?
  Composite Entities is a very complex plugin that completely changes how entities work. It was designed for advanced and complex scenarios. Since you’re still getting started, my advice is to stick with the basic setup for now.
  
  
• What are the best practices for automating entity creation in legacy GRC?
  When automating entity creation in legacy GRC, the best practice is to use the Entity Type with an Entity Type Filter which allows entities to be automatically generated based on specific conditions. It is essential to ensure that the CMDB data is accurate and up to date, particularly key attributes such as Owner and Active status. Keep in mind that if a CMDB record becomes inactive the corresponding entity in GRC will automatically be retired helping to maintain alignment between the systems.
  
  My advice is to make a diagram and verify what is the level of granularity you need. Sometimes been specific makes it easier to maintain. By been specific and not too generic you can enable a more precise filtering and avoid unnecessary entities.
  
  
• Has anyone implemented a similar setup and found a scalable solution?
  Yes. You want Business Applications and Applications Services right?
  
  I would start to use the filters:
  active = true
  install_status = In Production
  managed_by is not empty
  it_application_owner is not empty
  support group is not empty
  supported by is not empty
  
  After reviewing the results, if you’re still getting too many records, refine the filter conditions. Narrowing the criteria helps ensure that only the intended entities are created, keeping your GRC system clean and accurate.