Is there a way to apply acl to CiviMail's mass mailings?
Users shouldn't be able to see mailings if they don't have access to the groups that the mailings are to.  Note that this was broken not too long ago, so make sure you're using a newer version; see here; also relevant is this and this, which help if someone saves a draft of a sensitive mailing without specifying a group.

Also, note this patch, which is a related but different issue, and hasn't been merged into core yet.