Content access can currently be set in the workflow. It is very flexible in status, but when a content type is shared between channels the access can't be limited to a channel.
When a channel is enforced at admin/contenttype/article, you don't see it in the channel selection, which is strange.
In INTEGRATED-1321, multiple user groups can be added to a channel
When no groups have been added, everyone has access
Administrators always have access, no matter of their access settings (ROLE_ADMIN) (this should already be the case)
Being in one of the groups is enough to get access
Channels without read access are not visible in the Visual, because the user shouldn't see them .
On the content edit page, hide channels which the current user does not have read access to.
On the content edit page, disable channel checkbox for channels which the current user does not have write access to.
On the content edit page, check+disable channel checkbox for forced channel publication (even if he doesn't have access to publish on it because with the current requirements this combination is possible).
Make sure these rules can't be hacked by changing the DOM