In your ROM, go to Settings -> About device. Tap 7 times on Build number to enable Developer options.

Now go to Settings -> Developer options. (above About device)
You need to enable OEM unlock, otherwise you might end up with boot problems or be unable to flash later on.

Extract Odin 3.12.3.zip to your computer.

Install Samsung Mobile Phone Drivers for Odin to find your device.

Download a .tar image of TWRP for herolte.

Reboot your device into Download mode. To do this, select reboot from the power menu and hold the [Volume Down] + [Home] buttons while your device reboots.
Once you reach the Download mode warning screen, press [Volume Up] to continue.

Open Odin and place that TWRP tar file in the [AP] slot without touching any other options, then press [Start].

Hold [Volume Up] + [Home] buttons near the end of the flash, and keep holding them until you are in recovery.

At this point, you will reach the screen asking you if you want to allow system modifications.
By swiping right, you will trigger dm-verity, and if you don't follow step 11 you will be unable to boot!
If you are going to root your device and follow the rest of these steps, then it is safe to swipe right and enable modifications.

Only if you want internal storage or data to work in TWRP:
Go to [Wipe] -> [Format Data] (not advanced wipe) -> type "yes".
WARNING: This will wipe your internal storage, disable encryption, and factory reset your phone!
Go to [Reboot] -> [Recovery].

If you want to be rooted with SuperSU:
Download the latest SuperSU by Chainfire.
Without exiting TWRP, transfer the SuperSU zip to your device over MTP* and flash it using [Install] in TWRP.

If you only want a bootable system partition or writable data in TWRP:
Download dm-verity and force encryption disabler.
Without exiting TWRP, transfer no-verity-opt-encrypt.zip to your device over MTP* and flash it using [Install] in TWRP.

Go to [Reboot] -> [System].