Here's an example. The main difference to my current setup is that I'm installing nixGL through nix-channels because then I don't have to use --impure that way, although I still haven't gotten around to automating its usage so that might still change.
Basically I just have list of packages that I want installed (home.nix), and I run updates a couple of times a week. If something breaks (it hasn't yet), I could just roll back to a previous generation.
Do the Nix packages have their own isolated dependency resolution?
Each package has specified dependencies, nix downloads them separately and then symlinks them in order for the package to access it. If two packages require the same version of the dependency, based on the hash of the output, they'll each get a symlink of the same dependency. If they require different versions, it will download the correct ones for each of the packages.
That way you're theoretically never get mismatched dependencies, but it uses a bit more space.