restricting user just to get aggregated information
Plan A:  Use GRANT to not let that user see salary.

Plan B:  Provide Summary Tables (with counts, totals, etc) of stuff that you are willing to let them see, then restrict (via GRANT) their privileges on a table basis.  (Or put the Summary Tables in a different database.)