The only decision between picking Wordpress 4.x or 5.x is about the editor. If your customers are not afraid the new Gutenberg block editor, go for it. You can always go back to the classic editor by using a plugin (I believe this approach was supported for a few years).
Upgrading Wordpress is really a one-click operation but you should establish an environment with proper data backup and rollback in case something goes wrong. Some commercial plugins should do this nicely if you don't care setting it up yourself.
As for the PHP version, just pick the PHP 7.3. There are no breaking changes comparing to PHP 7 as the updates have been minor. You will also get all the speed benefits of PHP 7.
We're a place where coders share, stay up-to-date and grow their careers.
We strive for transparency and don't collect excess data.