If your database offers the capability to use row-level security (aka virtual private database), that should be your first port of call. PostgreSQL, SQL Server, Oracle DB DB 2 support this capability. I'm sure others do as well.
As for time limits, you can also look for other ways to constrain usage. I know that Oracle, DB2 (on some platforms) and Greenplum are able to set workload limits, so that queries can be constrained from acting as noisy neighbours to other queries on the same data. A less specific way to achieve this would be setting OS-level resource limits on the database processes themselves, such as a kubernetes request/limit setting.
But really, my best advice is to find a capable and experienced DBA for your particular database system. It's likely that a mature database has several ways to secure your data that you might not yet have thought of.
