How can I restrict access to some CiviCRM tables at the database user level?
Your objective is to protect the internal sensitive data from an attack on the public. An option is not to configure the defence on database level but to separate both sites (and run them on separate servers), and connect them with the CiviCRM API. To restrict the allowed API calls you can use CiviProxy