Visibilty of tabs for an object in a particular app can be controlled with app settings but it goes for all profiles automatically.
Object level security can be controlled by Profiles of individual users and record level can be controlled with OWD(Organization wide default)
following links will be helpful:
Record level permissions in salesforce is being controlled by OWD(organiztion wide defaults), where you can give access to a record in an object using role hierarchy or for special treatments for some particular users you can define sharing rules.
following link will be helpful in setting up OWD: