PostgreSQL 11: How to restrict privileges to stored functions?
If you want to use a function to give a user access to otherwise inaccessible data, you need to define it as SECURITY DEFINER and make the owner a user with the required privileges on the data.

Don't forget to


REVOKE EXECUTE ON FUNCTION myfunc FROM PUBLIC;


because by default, everybody can execute a function
ALTER FUNCTION myfunc SET search_path = ..., pg_temp;


so that the function is safe from privilege escalation attacks.