Spring MVC project structure

I am deciding the project structure for a small RESTful service. As for now, I see two designs. The first is by functionality. Many tutorials, another tutorial also uses this approach:

example
+- controller
|  +- CustomerController
|  +- OrderController
+- model
|  +- Customer
|  +- Order
+- repository
|  +- ...
+- security
+- service

The other approach, grouping by objects, is recommended by Spring docs. However, I am not seeing it quite often:

example
+- customer
|  +- Customer
|  +- CustomerController
|  +- CustomerRepository
|  +- CustomerService
+- order
|  +- ...

Can you please elaborate on when to choose one over the other? Or is it merely a preference? Especially for RESTful and RESTless applications. Also, if I group packages by objects, where should I place security-related classes that are not exposed?

In addition, according to one of the answers, grouping by funtionality will casuse problems later. There is a comment, but has not been answered since 2014.

Secondly, for implementation classes, there is a suggestion, also on this page, to avoid Impl suffixes. Why is it the case? Does Spring not explicitly require Impl and uses it as a default for Spring Data JPA Repositories?

CustomerRepository implements JpaRepository, ComplexCustomerRepository {...}

ComplexCustomerRepositoryImpl implements ComplexCustomerRepository{
  // Specifications and Examples and custom queries here
}

If this is an anti-pattern, what is the work around? Am I misunderstanding something?

Thank you.