The best practice for declaratively controlling Apex logic execution for specific users is to use a custom permission. The Apex trigger code would be written to check if the running user has this specific custom permission before executing its logic. An administrator can then create a permission set that includes this custom permission and assign it to the required users or profiles. This approach allows for flexible, declarative control without modifying the Apex code.

A. Process Automation Settings are org-wide configurations, such as setting a default workflow user, not for controlling trigger execution for specific users.

B. While a standard system permission could be checked, a custom permission is the correct, scalable, and purpose-built solution for custom application logic.

C. Apex Class Access controls whether a user can invoke methods from a class (e.g., via a custom button), not whether a trigger fires during their DML operations.

1. Salesforce Developer Documentation, Apex Developer Guide. "Custom Permissions". The guide states, "Custom permissions let you define access checks that can be assigned to users via permission sets or profiles... For example, you can define access logic in Apex that makes a button on a Visualforce page available only if a user has the appropriate custom permission." This principle applies directly to controlling trigger logic.

2. Trailhead, Salesforce Developer. "Apex Triggers" module, "Trigger Context Variables" unit. This module explains that triggers run in system context, but best practices often involve checking the running user's permissions for conditional execution.

3. Salesforce Help. "Custom Permissions". "You can use custom permissions to provide a way for administrators to grant access to custom processes or apps declaratively."