Best practice: needs private and public contents of same type
Perhaps the deciding factor is to determine if the private users need to see the private content seamlessly integrated into the public content.  If they do solutions 1 &amp; 2 seem like they might work.  If, on the other hand, private content can or should be viewed separately from the public materials, separating into two subdomains (or even subsites) with different access rules would be much easier.