What are the best practices for tagging Docker Hub versions

You should be able to do what you are describing via Docker Hub's Automated Build and in build settings, set up the pattern matching between your Github tag Name and the Docker Tag Name. You can use wildcards and the variable {sourceref}`, "which refers to the source branch/tag name".

Whenever you push a new image with a Docker tag that matches a Github tag, it will pull the matching Dockerfile -- the previous tags will remain untouched. So someone can pull an older Docker image and the matching Github code by using the tag as a reference as you mentioned:

ENV APP_VER=2.1.0RUN git clone ... app.git; git -C app checkout ${APP_VER}

In this case, it assumes you have Docker Hub set up to match the values and each tag (Docker image and Github) is 2.1.0

I'm not really sure what you mean by "each branch", that may be part of the confusion, especially if you're used to SVN. In git, a tag isn't tied to a branch but rather a specific commit (or ~point in time), so when you retrieve that tag, it's always going to use the same version of the code as it was when that commit was made. (Typically the same time as a release was cut.)