You can create some roles that correspond to the privileges with respect to seeing blocks on the form.

Try to create roles that apply to all cases/types of users so you can set permissions at a higher level within the form, then at each block (when_new_block) all you have to do is check for true/false for existence of a role/permission.

The roles don't have to be actual database roles. You can create your own user role table and reference that table for better performance. Your table will have columns
username, role or datablock name, permission.

select information about a user into a cursor or record.
evaluate the roles the user has
set global flags (boolean) for each data block "role" to true or false

User calls the form, his permissions are evaluated at when_new_form_instance, and you set block properties. The blocks he can see are shown, the ones he can't use are hidden. If it is a block that doesn't appear initially, you put in a trigger that checks permission to see the block when_new_block_instance.