You're on the right track, but let me tighten that up with how I'd actually approach it from a GTM + analytics implementation angle - because SEO isn't just about picking keywords and hoping, it's about measuring what happens after.
Here's the framework I've been running with for new sites:
1. keyword targeting: relevance first, volume second, difficulty third
Use Ahrefs or the Google Keyword Planner to build a list. Filter for keywords where your site could realistically rank with a few solid pages (think informational long-tail, not head terms like "SEO tool"). Check keyword difficulty - if it's above 30 for a brand-new domain, don't bother. Check search intent: are people looking for a service, or just reading? that decides your page type (service page vs. blog post).
2. Backlinks: quality > quantity, but relevance is king
A link from a SaaS review site with 10k monthly visits in your niche is worth more than 50 spammy directories. Use Screaming Frog to crawl your competitors' backlink profiles, then find sites that link to them but not you. reach out with a genuine value add (e.g., "I noticed your page on [topic] could use an updated resource on [specific angle] - here's something I wrote").
3. Authority is cumulative, not instant
GSC will show you impressions long before clicks. if you're ranking on page 3 for a keyword with 500 monthly searches, you've still got zero traffic. That's normal. Keep publishing topic clusters around that keyword and build internal links from your stronger pages. ahrefs Domain Rating will tick up slowly, but don't obsess over it - focus on the pages that actually convert.
The part most people miss: set up GTM triggers to track which pages are generating enquiries or sign-ups from organic traffic. Link that back to your keyword performance in GSC. If 'keyword A' brings 100 impressions but zero conversions, it's vanity. if 'keyword B' brings 20 clicks and 5 leads, double down on that topic.
So your understanding is directionally correct - authority matters, relevance matters, volume matters - but without the measurement loop, you're flying blind. Get GSC + GA4 + GTM linked up from day one. Makes the whole process way less "not sure" and way more "data says we do this."