For documents, have a look at documentation on dealing with file uploads and downloads. https://docs.mendix.com/howto/data-models/working-with-images-and-files#4-file-documents
For both requirements you’re looking at security and roles. Look at Xpath constraints and access rules. https://docs.mendix.com/howto/logic-business-rules/define-access-rules-using-xpath
The Mendix Academy also has a good tutorial on Xpath and security that will probably help. https://gettingstarted.mendixcloud.com/link/path/62/Constrain-Your-Data-Using-XPath
Best of luck!