You can do it either way. You can put a Relationship field on the user to specify posts they cannot see or you can put a User field on posts to specify users that should not have access. I would do whichever you think is the easiest to maintain.
Welcome to the Advanced Custom Fields community forum.
Browse through ideas, snippets of code, questions and answers between fellow ACF users