Hi Fawas Panat,

Well, I don't know the technical way. But, I did the same work without technical knowledge.

I use the below third-party module to set up user access rights.

Link: https://apps.odoo.com/apps/modules/16.0/simplify_access_management/

You can apply the domain to see only the respective user's data on any model including third-party in your case it is 'project & task'. Also, you hide the views, menus, Kanban links, buttons, and Tabs to restrict the user.

Thanks

Dear Fawas,

Please refer below groups for example 

Manager

<record id="sale_order_see_all" model="ir.rule">

        <field name="name">manager/field>

        <field ref="model_sale_order" name="model_id"/>

        <field name="domain_force">[(1,'=',1)]</field>

        <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman_all_leads'))]"/>

    </record>

User

    <record id="sale_order_personal_rule" model="ir.rule">

        <field name="name">Personal Orders</field>

        <field ref="model_sale_order" name="model_id"/>

        <field name="domain_force">['|',('user_id','=',user.id),('user_id','=',False)]</field>

        <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>

    </record>

change groups for this

 <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>