on the form, can use Form Builder > Advanced Tools > Permission. set the file upload to user group Y to have visibility to file upload and the rest of the fields as read-only/hidden.
Builder Advanced Tools - Knowledge Base for DX 8 - Joget | COMMUNITY
Or if you prefer on the list, can set a column with Download PDF Datalist Action Plugin from Joget Marketplace > View App Details & Download and set permission on the UI Category or menu level so only user group Y can see that menu
Or even on the Form Builder > Advanced Tools > Permission so that user group Y can see that column with the Download PDF Datalist Action Plugin
P/S: make sure your file upload permission is properly set and it is set to download as an attachment.
File Upload - Knowledge Base for DX 8 - Joget | COMMUNITY
