There is no right answer to this.
You need to use the capability or capabilities that allow the users you want to have access to have access and prevent the users you don’t want to have access from having access.
I would tend to create a capability and/or role in this kind of circumstance, but again, it depends on what you need.
It is pretty easy to create a role with add_role. Also see add_cap. A role management plugin can help you work out what you need and what you don’t.