Exam NCP-US v6.5 topic 1 question 67 discussion

An administrator created a bucket for an upcoming project where internal users as well as an outside consultant will be uploading data via Object Browser. The administrator needs to provide both internal and consultant access to the same bucket.
The organization would like to prevent internal access to the consultant, based on their security policy.
Which two items are required to fulfill this requirement? (Choose two.)