OK to demote the first account to a standard user?

Personally I would not bother to demote the first user on a new install, create the primary account and then create a standard user, using the First user account log- out and Log-in with the standard user.

When setting up anything you need to under the standard user you will be asked for administrator credentials (these are those of the the Primary admin), and just entering these will give the same result as if the Primary admin had performed the Action.

If you feel you need to do a lot as admin during initial setup - use the Primary Admin to upgrade the standard account to an Admin, and demote the account immediately after the set-up session is complete.

This system is not the only way of working but it does give you some proven structure to work to.

Also, remember to set the UAC level of the Standard user to an appropriate level (One below the top is normally best).

If you get access issues with the folder structure (old existing folders are usually the issue), log in as the Primary admin and set the NTFS permissions for the Standard user directly, ( taking ownership is not the best practice to take control of a system, it was designed as Just an emergency back door into the NTFS file system and is now used in place of correct procedure)

I would demote the first account to standard and always login from there, leveraging UAC with the password of the second account to do occassional admin-only tasks. I prefer this because you already have that account configured to your liking, and having to use a second means you have to reconfigure some per-user things. You could do the other way around to, but I find that more inconvenient.
Then, I would never login to the admin account directly, just use it to feed UAC prompts.

I think you'll notice little to no difference, once you get use to write a password instead of a simple "yes". A nice side effect is that one becomes consious of what and when get "superpower" over your computer. And after the initial setup, elevation request aren't frequent at all, at least with most sane software.

BTW, kudos for caring about security! Not a common thing here and internet in general

Barman58 said:

If you feel you need to do a lot as admin during initial setup - use the Primary Admin to upgrade the standard account to an Admin, and demote the account immediately after the set-up session is complete.

Why not simply switch to the admin user for this one time instead of changing the status? It should not be a regular thing anyway, and most of the "massive UAC prompts" are found during the initial setup of everything. Afterwards, UAC prompts should appear minimally, if ever.

Barman58 said:

Also, remember to set the UAC level of the Standard user to an appropriate level (One below the top is normally best).

There is no "UAC level of the Standard user". UAC is a system-wide settings, affecting all accounts the same.
Also, I have to disagree that one below top is the best. I call it the worst possible setting, as it has a critical bug that allow anything to elevate without consent or knowledge, a bug acknowledged by MS that they refused to fix, even up to Windows 10.