Is it possible to restrict access to raw user data in fine-grained manner?
Android official supports multiple users with profile restrictions:

https://support.google.com/nexus/answer/3175031?hl=en

I think there are several 3rd party ways to do it (Like Maas360 software) that can also do multiple user profiles

I don't k now if "android restricted profiles" meets all of your needs, but I think this is the starting point for controlling a device that may have multiple users with different roles.