Hi,

->Go to Settings > Technical > Security > Record Rules.
->Create a new record rule for the model you want to restrict access to (e.g. Contacts ).
->Set the Domain to ['|', ('user_id', '=', user.id), ('user_id', '=', False)]. This domain will restrict access to records where the user is the owner or the owner is not set.
->Set the Apply for Read field to Yes to apply this rule when reading records.
->Set the Apply for Write field to Yes to apply this rule when writing records.
->Set the Groups field to the appropriate group(s) that should have this restriction applied to them.

Regards