AEM assets enable download button based on user group permissions

AEM as a cloud service 6.5

I'm looking at directions to disable asset download based on user groups permissions.

There are two download buttons in the assets console

- one in the top rail when you select an asset

- another as an icon on the asset card

I can think of overlaying the node to define custom behaviour

1) Can you please point me to the node which needs to be overlayed ?

2) How do we toggle this behaviour for different user groups. I'd like to set just one group to have download restriction and the rest of the groups can download.

Any sample code, references will be greatly appreciated.

Thanks in advance