How can we restrict EFF accesses by roles?

Suppose we have two roles, manager and employee. We want to operate contradictory rules for these roles' EFF access. For example, the employee role cannot access and view the A EFF field, while the line manager role should be able to view and edit this field.

What is the optimal solution for this EFF view authorization?