With the sync gateway you get pretty fine grained control. Every create or update goes through a sync function you can define in JavaScript which can deny requests. You can control which users see what by assigning the document to channels. So a user can only pull down documents if that document is on a channel they have access, too.

The issue I've found with the sync gateway is that the queries you can perform are more limited than what you can do directly on a Couchbase store e.g. joining data is difficult.

BTW, Couchbase should not be confused with CouchDB. Similar name and might have some history in common, but Couchbase is more fully featured.