True.
As rcaballe said, object access is managed thru grant and revoke.

Best way is to create the roles for individual tablespace objects and
granting the roles to the users.
Hope it makes sense.