So what is the correct way of handling TLS and NCS?
nothing special. Just ask phenix.refine to use TLS (define TLS groups or ask phenix.refine to find them automatically - this is very quick, may take a minute or less), and also ask phenix.refine to use NCS restraints.
For NCS restraints you have two options: use Cartesian or torsion NCS. For Cartesian NCS you can let phenix.refine find groups automatically (the algorithm is not very smart though) or provide your atom selections for NCS groups yourself.
For torsion NCS you don't have to do anything; and this is the recommended option.
A very simplistic example using command line (sure, all this is available in the GUI !):
phenix.refine model.pdb data.mtz strategy=individual_sites+individual_adp+tls main.ncs=true ncs.type=torsion tls.find_automatically=true
On the phenix website it says under
current limitations of phenix.refine "Atoms with anisotropic ADP in NCS groups". I take this to mean that phenix.refine doesn't handle the combination of TLS and NCS well, is this correct?