My suggested super-short introduction:
When you boot into Qubes OS for the first time, you will have the following virtual machines for your service. Sys-net contains drivers for your WiFi card and connects to the network, so it’s untrusted by default (don’t run Firefox there!). Sys-firewall protects you from DMA attacks and allows to use the “Firewall rules” in the Settings of other qubes. Sys-whonix provides Tor connection to anon-whonix (in which you should run Tor browser). All connected usb devices go to sys-usb qube by default, to protect you from USB attacks. If you need to connect them to other qubes, use Qubes Devices widget. Vault qube has no network by default, making it a good place to store your secrets. With personal and work qubes you can separate your private and working lives by running related things in them. See this for an example.