There are so many types of social engineering attacks – how should we determine which ones to focus on for employee security awareness training?

Based on what we've seen for statistics around ransomware events, over 90% of all ransomware attacks start with a phishing event.
I would focus my primary training on how to recognize and not fall victim to social engineering events from phishing.
Beyond that we also provide training on other categories.
The training platform we use is KnowBe4.  It works great for overall cybersecurity awareness training and phishing exercises.

You need to tell people what to expect and what not to expect from IT. We’ve tried to train people to expect that IT will do certain things or make requests which are okay to comply with, but IT will never call you out of the blue and ask you for your password, for example. We're never going to call and say, “Go ahead and enter the two digit MFA code.” You have to help people understand what is expected behavior and what they should be suspicious of.