That depends mostly on your application.
There is no way to give you any hint without knowing the details.
So I recommend to enable the GC logging for the JVM and do a load test - with a load similar to what you expect in production.
If you have short running requests and no huge memory consuming objects I suppose a smaller heap 1-2GB will work best
For the GC policy you need to measure whether NewParallelGC, CMS or G1 (since late Java7 or Java8) will work best for you, it depends also on your requirement whether you need best throughput or smallest GC pauses.
The Oracle GC tuning pages might give you an idea