As an example, check the access group “Sales / User: Own Documents Only” which has a Record Rule on Sales Orders (and Quotations) with this domain:

['|',
   ('user_id','=',user.id),
   ('user_id','=',False)
] 

This will only allow access to a user’s own orders / quotations (or any with no salesman (user_id) specified).  Then you need a second Record Rule to allow other users access to all quotations.

https://odootricks.tips/record-rules/

you should use record rule for that 
https://www.odoo.com/documentation/13.0/reference/security.html#record-rules
https://github.com/odoo/odoo/blob/12.0/addons/mail/security/mail_security.xml#L46