You should use different roles for this groups of users, like CPT-Editor or CPT-Reader. It is much easier to check the role and his capabilities to change on posts. To change this capabilities in the roles use a plugin, like Members, or custom code. The capability for edit, read cpt is different, in dependence of your plugin, that add this CPT.
This question is really helpful in this context, via plugin and custom code is a answer deposited.