If you are using the standalone entry form, (see this page: http://expressionengine.com/legacy_docs/modules/weblog/entry_form.html), the {custom_fields} loop pulls all the custom fields out automatically to display them, without you being able to do much to control them.
You are able to affect how each TYPE of field is displayed (i.e. textarea, textinput, date, relationship), so if all your restricted fields are the same type then you could put an if statement around them that would restrict access to certain groups. However it would affect all the “textarea” fields for example, and you couldn’t restrict some and not others.
So you might do something like this inside the SAEF:
{if textarea}
{if member_group == 3}
<textarea name="{field_name}" dir="{text_direction}" cols="50" rows="{rows}">{field_data}</textarea>
{if:else}
<!--show what they are allowed to see or leave blank-->
{/if}
{/if}
However at the bottom of the page, in the last comment, it mentions being able to do away with the {custom_fields} loop and just referring to the fields directly using their database name, such as field_id_?? where ?? is the field number. You’d have to look that ID number up in the database.
I hope this is helpful, and others can feel free to correct me if I’m wrong! I’ve had to do a lot of SAEF forms lately and I’ve come up against similar problems. Good luck.