How to allow users to run a function, but not access objects the function is accessing
Yes that's possible. Create the function with the user owning all those tables and use the SECURITY DEFINER modifier. 


  SECURITY DEFINER specifies that the function is to be executed with the privileges of the user that created it.


create or replace function foo()
  returns void
as
$body$
...
$body$
language plpgsql
security definer;


Also see the example in the manual:
http://www.postgresql.org/docs/current/static/sql-createfunction.html#SQL-CREATEFUNCTION-SECURITY