Is this a use case for user custom fields?

Discourse uses groups and categories to control access to content. Have a look at the video in this topic for details: How to use category security settings to create private categories