You're managing data access for the analytics team at InsightPro Inc.. You want to centralize shared reference tables into a single BigQuery dataset, allowing all analysts to read (but not modify) these tables. Additionally, each analyst should have access to their own private workspace—a separate dataset within the same project—where they can create and manage tables without other analysts seeing their work. What is the best way to configure permissions to meet these requirements?