It depends on how your menu is built. If it uses a pagetree control for example, the access rights will filter out the pages which the user does not have access to. If it's constructed in some other way, for example if you compile a PagaDataCollection to use in a ListView or something like that, you can use Filters.FilterForVisitor to do a one-step filtering for access rights, publish state and the visible in menu property.

You could put those users in a certain role. A different approach could be to introduce a Virtual Role in which you can perform any logic you like to determine at run-time if the user should be in the role or not.

As I see it, you have to ask yourself why you are hiding the menu item for some users. If you don't want the users to be able to see the page, neither by navigating to it in the menu or by somehow getting the direct URL, then requiring users to be in a certain role to have read access rights is probably the way to go. This is what roles are meant to do. If for some other reason you want to hide the menu element but not strictly limiting the users access to the page, you should use a different approach. For example, if you're using a PageTree you can cook into the Filter event and do any filtering you like based on the currently logged-in user.