The second method is probably the best way to do what you want.
Id
- Add a field to your User entity to specify what “catalog” they have access to
- Create a field in your Product entity to specify what “catalog” they belong, then create a middle
- Create a middleware that reads the “catalog” field from User and filter the products by the right catalog.