Restricting user access to certain data sources

Hi all,

We would like to give someone access to a subset of some collections.

We noticed it is possible to add a Data Source and specify a $match stage in the Pipeline. This is what we need because we can pre-filter a collection exactly as we want.

However, it does not seem possible to add a new user to our project and only give said user access to this specific Data Source. We must provide Read-rights to the full database - all Data Sources.
Is this correct or is there a way to limit the available Data Sources for some users?

The whole point is to hide certain documents for this user, so if we need to give full access, the $match stage in the pipeline has no value because that user can still browse the full collection anyway.

I would also like to challenge our approach from above: The reason we want to be able to create certain users with restricted access is because we want to give some of our customers access to the database, but only to their own data. So if we can pre-filter a collection, we can make sure they can only access their own data.
Charts queries the Secondaries, so the impact on the Primary is limited. Still, this doesn’t feel like the right approach for our use case. It would be better if we can make a copy of our database into a seperate database and while copying pass a filter to only migrate certain documents. Then, we can give our clients access to their own database with only their data in it. This removes the risk of heavy queries on our own operational database. Our clients are already familiar with Charts from previous projects and like to work with it. I would think it is possible to accomplish this via a native MongoDB tool?
Is this what the BI connector is made for, or is this a use case for Data Lake?
Is there a way to set up a copy of our database that automatically syncs every day or week or so, but it should only contain a subset of documents?

Or should we set up a new cluster in a new project, and use some Realm function to keep it in sync with our operational database? Then build a fallback for re-syncing if there is any down time etc…

Thanks in advance!