We have one database with multiple schemas.
Different departments have their own schema, which only they should be able
to read/write.
We also have 1 reference data schema that all users of the database should
have read access
What is the best way to secure the data?
Proposed Method 1 (which I've been trying to do):
1. Define groups to the database with datareader and datawriter permissions
to the database
2. Create views on the tables.
3. Grant the appropriate AD groups read/write to the views
4. Deny public access to the underlying tables
Issue with this method is what is the best way to keep departments from
reading another department's schema without having
to specify them by name in a DENY SELECT statement - this would have to be
done every time we add a new group to the database.

Proposed Method 2: (based on postings in this forum)
1. Define groups to the database with datareader and datawriter
2. Change the owner of the departmental schemas to an AD group that contains
only the users that should have access to the data in that schema
For the reference schema, grant select to public
Remove all grants and deny's that were previously done on the views and tables
Will this method provide adequate protection?