What are the best granular security options for custom post types?

We need to limit custom post types to admin and specific groups. Ideally, it can be assigned by tag or category for specific groups. I.E., people in super admin or office admin can see and edit all this, people with this client group can manage this. Only super admins can assign permissions.
Does CustomPress give these levels and how, or are there easier niche options to explore?
Thank you!