SharePoint 2013 Document Permissions

Question

I have a (what I thought is a simple task):

I would like to set permissions on my SharePoint 2013 on-premise as follows:

1. Each department has its own site (e.g Finance, HR, Admin etc)
2. I would like all Staff to be able to browse to each department site
3. The documents library should be accessible to members of the department in question
4. The files/folders in the document library should have "List only" access to all other staff except if a particular file/folder has been explicitly shared with them.

Sounds simple right? Here's the problem I have: Number 1 is done Number 2 is done Number 3 is done Number 4 I have managed to do by granting View Only access to everyone and Read access to the Departmental members as needed.

I am not sure this is the best way to do it but it seems to work. Staff that are not members of the department can access the site, see the list of files but cant open them. However.... I also have Office Web Apps and if they click the file it shows the contents of the file in Office Web Apps which is pointless if you don't want them to see the contents. Prime example would be HR site. They have some very sensitive documents that should not be be seen by staff but other documents that they wish to share will all staff.

How can I achieve this seemingly simple task??

Answer 1

You can make the customize permission in the view only. Then save it as a new permission. There is one thing to open the document in Client Program by default under the advance setting of the document library. So it won't open in the Webapp. Please let me know for more questions.

Answer 2

No. 4 is a duplicate question for Allow users to view items in Document Library, but not open the files

But here is how I would do it.

1. Create a new view and replace name linked to document with name for use in forms.
2. Also deselect tabular view and save.

Note: Search will still return documents that can be opened. The view can also be switched to the editable view(audiences might help).