Postgres has access control and an extension mechanism. Would the easiest be to use a real postgres server?
1) you need to separate any non-queryable data into it’s own table. So you’d need _public and _private tables for most data types
2) any type of filter query will need a JOIN, which leaves you vulnerable to malicious long running queries
3) some tables you don’t want people to run SELECT * on, otherwise they can get your entire site data
4) you need to be really careful with DELETE, UPDATE and INSERT queries to prevent malicious behavior
Maybe one way would be to write a bunch of whitelisted regex patterns for allowed queries, but you’re definitely playing with fire allowing someone to send SQL queries to your DB.
Things like personal user / marketing info, internal data / metrics, etc.