Model Rules By Permissions

Hi,

I have a model that permit the users with credential permissions to change fields of this model.

I want those users to have only permission only to specific fields.
On the other hand I want the admin (full permission on the system) able to change all the fields.

The easy way is to hide the fields on the user form, but this is not a secure way (for example a hacker could post a form with all data)

The other way is creating another model with same fields (and table) but without all fields. The first one can be use for the admin and the second one for users, but his way is not very reusable and robust.

So, does anyone has any suggestion?

Thanks