To specify objects and fields users can access, use permission sets and profiles. Use organization-wide sharing settings to specify the individual records that users can view and edit.
We don't exhaustively cover other security considerations, such as organization-wide defaults, sharing rules, user role hierarchies, etc. We leave it up to you to determine what's appropriate for your institution's security model.
For an overview of how security works, see Security Recommendations for Salesforce.org Products. Then head over to Trailhead and check out the Protect Your Salesforce Data trail. Also review Control Who Sees What in Salesforce Help.