How to make security group see only own contacts in Odoo 15?

I want the security group User: Own Documents Only (sales_team.group_sale_salesman) to see only own contacts (records from res.partner with user_id field matching the current user ID).

It's easy to make a rule for that, the problem is that it won't work, because if you belong to sales_team.group_sale_salesman, you must belong to base.group_user too, and this user can also see almost all contacts, due to the following rule:

• base.res_partner_rule_private_employee: it allows to see all contacts which fulfill the domain: ['|', ('type', '!=', 'private'), ('type', '=', False)]

So if I add a new group rule which sets the domain [('user_id', '=', user.id)], it won't work, because group rules are added with OR, so if doesn't matter if I am the salesperson of a contact or not, if the contact is not private, I'll see it.

Then I thought it would be as easy as modifying the rule base.res_partner_rule_private_employee in order to set this domain_force:

• [('user_id', '=', user.id), '|', ('type', '!=', 'private'), ('type', '=', False)]

But after that, the problem is that every user belonging to sales_team.group_sale_salesman (or only base.group_user) gets a security error each time they log in, complaining about access to res.users model, the surprising thing is that it doesn't blame any rules...

So after that I created a new rule to control that error:

<record id="rule_own_users" model="ir.rule">
    <field name="name">res.users.own.users</field>
    <field name="model_id" ref="base.model_res_users"/>
    <field name="domain_force">
        ['|', ('id', '=', user.id), ('partner_id.user_id', '=', user.id)]
    </field>
    <field name="groups" eval="[
        Command.link(ref('base.group_user')),
    ]"/>
    <field name="perm_read" eval="True"/>
    <field name="perm_write" eval="True"/>
    <field name="perm_create" eval="True"/>
    <field name="perm_unlink" eval="True"/>
</record>

But despite that, I get the same error, this time blaming my new res.users rule.

Does anyone know hot to manage my purpose or what is my mistake?

EDIT

I guess the problem is that any user needs at least see the partner related to its own user (and may be other like OdooBot) and the partners related to the companies he works for. How to add them to a res.partner rule?