Hide item by user criteria, but allow the use by url

Hi,

I need to hide an item (record producer) in the Employee Portal at the end to have this 3 possible configuration:

1- Users that see the item on the portal and use it

2- Users that not see the item by the portal but can use it by URL link

3- Users that can't see the item and can't use it 

By the User Criteria I'm able to reproducer the possiblities 1 and 3
but not the the number 2. 

How could I have all 3 functionalites ?