Limit access to work items (based on tag or similar)

I need to restrict access to all work items in a project, based on a tag or a field - is that possible? 

As in: due to compliance restrictions certain users may only see work items with a specific tag, nothing else really (at least not something with screen dumps and descriptions in it)

Alternatively: is there a way where I can place these users in a separate project and let them view (maybe edit) only these specific work items (without doing double administration, having to maintain them in both projects)