Recommended location to set response headers?

There’s a filter for that:

function wpse_203745_wp_headers( $headers ) {
    $headers['Expires'] = gmdate( $somedate ) . ' GMT';
    return $headers;
}

add_filter( 'wp_headers', 'wpse_203745_wp_headers' );