“Advanced Custom Fields” plugin protects its “Custom Fields” menu and all submenu items with ‘manage_options’ capability. It’s possible though to grant this critical capability to a non-admin role, but block unneeded access using “Admin menu access” add-on.
As about access to the custom post types, it depends from how this CPT was defined. Read this article for more information.
‘read_private_pages’ should allow to view any private page. User just should know the URL.
It’s possible to further manage view access via “Content view restrictions” add-on.
