Global limitation by vendor class

If I want to do a global limitation by vendor class, can I (a) do it at the element level  or (b) table level APVENMAST - or do I need to limit multiple tables or (c) do I need to do it at the form level also. It seems to be working by just doing it at the table APVENMAST level on Inquiry security classes but perhaps I am overlooking something. Can anybody point me to a good document outlining advanced security rules?