Schema design for privacy settings in MongoDB
Your documents can contain some inline privacy section-document or reference to that document in some security collection (for example) where you can specify whether to access.
On the assumption of your problem it can be looks like:

{
    "status":"private", // one of allow-all, private, deny-all
    "deny":[_id('user'),...],
    "allow":[_id('user'),..]
}


where "status" is the main policy for document witch will be handled with your code.
It is just an example. It can be done with many different ways.



Cheers.