In my experience, this is typically done one of two ways (or both).
1: Create separate layouts for different privilege sets so that the fields in question are not even on the layout.
2: If it is entire records they can't see (not just certain fields), control the found set that the user works within so that they are always within a found set they are allowed to see.
Example: I have a "Show All Records" button on my layout that does not show all records...it shows a found set based on the user's privileges.
Said found set is shown on a layout (also selected according to privilege set) that only has fields that they are allowed to see.
The actual "Show All Records" function in the menu and on the keyboard shortcut are disabled.
The user does not have the ability to reach a <<no access>> field.