As well as the very thoughtful replies above, I have a few crude rules-of-thumb that I fall back on.
1. Put a clock on the table. A 6-clock is a decent default.
A 6-clock will take three successful rolls at standard effect - more rolls if they fail, less rolls if they push for effect or whatever. Not every roll will be against the obstacle clock; hopefully there are other things going on at the same time. For example, from our game of Scum & Villainy last night, the PCs were fighting a patrol of battle droids at the same time as they placed thermal detonators at the same time as they tried to steal some precious cargo before time ran out. Phew! A lot going on. Only some of the rolls at any given time were against the “battle droids” clock. For our table and with the session lengths I prefer, I find that a 6-clock gives pretty good pacing. I might use a bigger clock for a really climactic moment.
2. Have a consequence-buffer clock.
I like to always have an “impending doom” clock on the table during a score. This adds tension to every roll and all proceedings, without actually snowballing handicaps (which is what harm and using up resources etc tend to do). The PCs can never quite relax, even when things are going smoothly, when there’s an impending doom clock in front of them. It’s also a good fallback for devil’s bargains (tick the clock) and for consequences when I can’t think of anything else (ticking a doom clock is less punitive than harm). Examples of impending doom clocks include the alarm being sounded, back-up arriving in full force, the reactor exploding, the hostages being killed, etc etc. Something bad that will seriously jeopardise the mission; stakes that aren’t just “the PCs get hurt or die”. The most important part - if the clock completes, follow through on the threat.
3. To contradict the above, not everything needs a clock.
Clocks are a pacing mechanism. By giving an obstacle a clock, it’s going to take up time on screen and become a proper story-beat. You have to follow your instincts about whether any given obstacle deserves a clock or not; not everything does. This really has to be instinctual, since it’s a question of how long your session is, how far through you are, what has happened so far in the score - it’s purely a question of pacing. If things are going too fast and feel weightless and easy, put an obstacle clock in. If things are getting bogged down and feel slow, don’t use a clock and let a single roll carry forwards through a few story beats.
If all else fails and the game still feels too easy, use those partial successes and failures to try and get them into a desperate position (they can only resist this so many times, and in my experience players don’t care so much about resisting position-changes anyway). Once the PCs are in a desperate position, the game becomes very punishing! And, in my opinion, very fun. Having said that, once they’ve had a taste of desperate consequences I usually let them climb out without too much fuss. As you said, over-compensating and being too punishing isn’t much fun either, and desperate consequences really snowball.