You could employ schema to segregate your objects (I don't and think it would be irritating to have to include schema in every query), otherwise you have to live with your decision to apply user level permissions to database objects. I'm curious, do your users access your database direct (SSMS/QA) or only through an application?
Never underestimate the power of human stupidity RAH