Applying security to multiple apps ?

I have recently been ordered to apply some form of security to our app that is gaining a second app in its database. Users will be granted access to one or both apps. How do I stop the swines (sorry, that should be 'users') from accessing tablespaces from the other app in the event of them not being allowed?

Please bare this in mind:
I don't want to apply quotas to users (150), I would therefore prefer to stick to roles, I would like to stay away from public synonyms (because of the number of tables, and possible inclusion of more apps)

Further (I'm sure the solution to the above can be applied to the next question),
The first app is being modularised (one module, one tablespace) and must also grant access to that module only if a role permits.

What sort of grants would do this ?
I can do this I'm sure, but without your input I'll make it far more complicated than it should be. So save my database and guide me through this sea of ignorance.

All replies warmly welcomed...

-- 
Guy van der Werf - guy_at_londonoffice.com or guy_at_sydneyoffice.com
Director, consultant, designer, developer and tea-boy at
Libran Systems Ltd, UK