Securing machines on a domain from malware/ransomware

Seems most SMB networks have domain admins (most of which have separate accounts, so the domain admins don't log into a computer with the domain admin account unless performing some sort of work that requires domain admin access)

I wouldn't say most, just some. An increasing number are doing this. Yet conversely, I still see a number of networks where this doesn't hold true.

.. but I've seen a lot of networks where the domain user that logs onto a particular machine is given local admin rights on that machine.

This is true. Some places feel that users should be able to do whatever they need on their local machines. With the number of threats out there, an increasing number of people are realizing that the idea of least privilege actually helps keep networks more secure. In turn, more networks are utilizing this philosophy... however, getting there is never easy (it's harder to take away rights than to provide them). The less rights an account has, the less damage a compromised account can do to a network. Now, let's be honest: there are going to be times where exceptions to not granting local admin rights must be made, be it for reasons related to the type of user or the software that they utilize (a number of programs require admin rights to work properly).

Also have heard it's not a good idea for a domain admin account to ever log onto a user's workstation

There are times where this is necessary. It's not a good idea for there to be excessive admin accounts. Also not a good idea for people to have a domain admin account as their regular account.

... it would be better for a service account to use a regular domain user account, but one that's local admin on the server it needs (rather than a full out domain admin account)

A more appropriate wording would be a sservice account that has the rights that it needs on the local system(s).

Now that said, this is only a subset of what should be in place. User education on phishing and potentially malicious emails are very important as well. A good spam filter should be in place with your email. There should also be appropriate use and security policies in place as well. Within the scope of security policies would include password standards/requirements incident response, and disaster recovery. Backups are also very important, along with ensuring proper endpoint protection (malware, virus, etc.). Web monitoring and filtering are also very beneficial, as these are things that will help you track down problems if any occur. Also maintain as few remote access mechanisms as possible. Do not allow RDP directly into your network (an RD Web Gateway is acceptable).