I want to block an email address in Postfix, from idiot@spamcompany.com

I've found on Google that I should use check_sender_access. The question is, where should I put it?

It seems I can put it in either smtpd_recipient_restrictions or smtpd_sender_restrictions. Which should I use and why, and what's the difference?

A common theme throughout the internet seems to be putting all the settings into smtpd_recipient_restrictions and skipping smtpd_sender_restrictions, even if the setting was specified under the smtpd_sender_restrictions in the Postfix docs. Why do people do this?

The difference is the stage in the SMTP transaction the restriction is applied. See this article for some explanation.

There's really no significant disadvantage to using smtpd_recipient_restrictions; in fact, in newer versions of Postfix, sender_restrictions won't be acted on sooner than recipient_restrictions.