Hi,

If we have to restrict access to a model using a security group, we can use groups attribute or set access rights in the ir.model.access.csv file. If you have conflict with One2many fields from the model in the view of another model, then you can try using a boolean field with a compute method and attrs attribute for the One2many field to hide it. Here, we are hiding the fields based on the user group and independent of the model:
(Example: Hiding the order lines of purchase order from custom module based on a group)
Security group:

< record id="group_purchase_editor" model="res.groups">
        < field name="name">Purchase Order Editor
        < field name="category_id" ref="base.module_category_inventory_purchase"/>
    < /record>

class PurchaseOrder(models.Model):
_inherit = "purchase.order"

    purchase_order_editor = fields.Boolean(
        string='Editor', compute='_compute_purchase_order_editor')

    def _compute_purchase_order_editor(self):
        """
        This function is used to update the purchase_order_editor field
        based on the user group
        """
        for record in self:
            record.purchase_order_editor = False
            if record.user_has_groups('custom_module_name.group_purchase_editor'):
                record.purchase_order_editor = True

< record id="purchase_order_view_form" model="" rel="ugc">ir.ui.view">
        < field name="name">purchase.order.view.form.inherit.custom_module_name
        < field name="model">purchase.order
        < field name="inherit_id" ref="purchase.purchase_order_form" />
        < field name="arch" type="xml">
            < xpath expr="//field[@name='partner_id']" position="after">
                < field name="purchase_order_editor" invisible="1" />
            < /xpath>
            < xpath expr="//field[@name='order_line']" position="attributes">
                < attribute name="attrs">{'invisible': [('purchase_order_editor', '=', False)]}
            < /xpath>
        < /field>
    < /record>