Sounds like the same problem as I was tackling last week. I also couldn’t find this in the tutorials.
@Darren_Murphy came to my rescue (he does that a lot). Here’s the thread Help planning out access & authorisation - #4 by sumgii
It sounds confusing, but works well.