Two different things
A citation is a mention of your business details — name, address, phone — whether or not it links to you. A link is a clickable path from another site to yours. Local visibility uses both, in different ways.
Citations mostly help by corroborating that you exist and your details are what you say they are. Links can also send you actual visitors, which is the part owners forget to value.
What is worth having
Links from places a real customer might plausibly be: the local paper, a trade association register, a supplier's "where to buy" page, a club or charity you genuinely support, a directory people actually use.
The test is simple and it is not about SEO: would you be pleased to be mentioned there if search engines did not exist? If yes, pursue it. If the only conceivable reason is ranking, that is the definition of a link scheme.
What will hurt you
Paid link packages, private blog networks, mass guest-post placements, and reciprocal-link exchanges are link spam under Google's policies. The risk is not that they stop working — it is a manual action that removes you from results entirely, which is far more expensive than never having done it.
This is also why an honest directory sells visibility and advertising, never "a dofollow backlink". Paid placement should be marked as sponsored, and that is the correct outcome, not a loophole to avoid.