Openzeppelin has ERC721 upgradable which can be used to write upgradable erc721 contracts and then can be deployed and upgraded using openzeppelin's deploy and upgrade proxy.
My doubt is what's the exact difference between using ERC721Upgradable vs UUPS in a NFT smart contract? Should one is enough or both should be used?
How can I verify that only the admin can deploy new implementations?
ERC721Upgradeable is the upgradeable version of ERC721. It contains all the token logic (transfers, aprovals, ...) with initializers that are upgrade-compatible. It does not however contain the upgradeability logic.
In order to build an upgradeable contract, you need to combine an implementation and a proxy. The implementation is where the ERC721Upgradeable code is.
Depending on your proxy, you may or may not need to put additional code in the implementation:
If you use a TransparentProxy, then the upgrade logic sits in the proxy itself, and there is no extra work to do on the implementation side
If you use a UUPS proxy, then the upgrade logic must be in the implementation. That is where UUPSUpgradeable becomes relevant.
You can use the wizard to switch between the upgradeability modes and see the effects on the implementation code.
For your last question, it really depends which mode is been used. I don't think there is one generic answer to that.