Entity Reference + View + security
You might be able to get this to work by using the Rules module.
Depending on how the format of your URLs look like, you may want to also use the Rules URL Argument module. Here is a quote about it (from its project page):


  ... provides two rules conditions based on URL arguments:
  
  
  check if a URL argument is present.
  compare the value of an URL argument.
  
  
  It also provides an action that makes the value of an URL argument available as new variable to Rules.


The newly provided Rules actions and conditions can be found under the "URL Argument" conditions and actions groups in the rule configuration interface. Using those you might be able to build an appropriate rule to issue a redirect (+ display a message if needed) based on some Rules Conditions that implement your access restrictions.

For more details, refer to my answer to the question "How to use the Rules module to implement a custom redirect for an outdated URL?".