One approach could be as follows:

1. Expose a custom visitor group or virtual role to work with the customer contact field
2. Use standard permissions in admin mode to set permissions in the content tree where you store media

On a note of David's if you create a visitor group criterion you can use this with the page permissions as well so this gives you the flexibility of either page level restrictions or blocks/conent via the personalization system.