Correction: There is never a need to disable SIP. Disabling SIP should only be done for testing purpose (for example to test unsigned Kexts), but in everyday use, disabling SIP is not necessary and increase security risks.
With Clover injection and patching everything required for a Hackintosh can be done by Clover and in that case it works even if SIP is kept fully enabled (0x0). Even to use old NVidia Web Driver a Clover patch can be used to disable the check on macOS build.
As a bonus feature of that practice, is that the files in the system partition are totally untouched and so a backup of it (being with TimeMachine or Carbon Copy Cloner or any other backup tool) can be restored even on real Macs.
In a nutshell: The best practice for using unsigned Kexts or patching installed Kexts is to use Clover Kexts injection/patching functionally and keep SIP fully enabled (0x0).