Record level permissions

Answer 1

You should probably create a VIEW which limits the records and then apply the proper rights on the view.

Answer 2

You could create a VIEW, or you could create select stored procedures and only assign rights to those.

The VIEW is the way to go for a simple security model - if it is complex, go with the stored procedure(s).