Explanation
The Apex method that must be used to make sure only allowed fields are shown to the users is isAccessible(). This method returns true if the user has read access to the field, and false otherwise2.
isReadable(), isShowable(), and isViewable() are not valid Apex methods for checking field-level security.

Public Groups are the most flexible method to grant access to an unrelated group of users. Public Groups can include individual users, roles, and roles with subordinates, allowing for granular control over which users gain access to records. Sharing sets and role hierarchies are less suitable because they rely on predefined relationships, such as account ownership or role-based hierarchies, which may not apply to unrelated users.
By leveraging Public Groups, administrators can define and manage record-level sharing without requiring additional custom logic. (help.salesforce.com)