Inside your tab you can do whatever you want - it's just a custom web app/page. The only "restriction" aside from a normal web app, is that it must implement the Teams javascript library - see here for more. However, once you've implemented that library, you can get the Teams context, which includes the user's Azure AD Id and also UPN, and you could use one or both of those to do a lookup against your database, determine the user's role, and show/hide UI elements accordingly.
However, I think you might be asking about whether the entire Tab -itself- (i.e. even the tab item inside the Teams client) can be hidden from other users. To do this, an option is to use a "private channel", just for the relevant users, and pin the tab inside there only.