Access to a contact is set up via “Change access” link on a contact-viewing page.
By default, all CRM users have access to all contacts. If you need to limit access to a certain contact, select a vault for it:
... or individual users:
Access setup by vault is convenient for user groups, and by-user setup is usually used for individual users.
Access setup by contact vault
If you select a vault, then only users who have access to that vault enabled in Team app will have access to this contact.
Contact classes setup is available in “Settings → Vaults” section.
You can enable access to vaults for user groups in the vault list without having to open Team app.
Access setup by individual users
If you select individual users rather than vaults, then those users’ access settings for CRM vaults will be ignored as far as the contact you are setting up is concerned. The only thing that will matter will be that those users are selected in this contact’s access settings.