CiviCase: How to handle confidential cases
You can do it in reverse if regular users have only "access my cases" permission. If they need access to cases that aren't theirs they can be added as any role to that case which will let them see it. But it sounds like you want the default to be to allow at the start, so then at that point you're into some kind of coding anyway. But then rather than access hooks, your postprocess hook on a new case would add in all the other staff as a role unless the custom field says don't.

If you want to generalize it, the custom field could be a multiselect list of groups, with the default being an "all staff" group.