The user doesn't have to control the privacy. You can set it to moderator controlled privacy then set the defaults and it should apply to every user and only allow moderators to change it. The alternative is to place your tab in a not shown on profile position, leave its access as public, create a new tab with the access you're wanting to see the fields, then use delimiter fields to substitute in your private data to your new tab.

Don't understand the question, sorry. REGEX for what? If you mean for delimiter fields, no. You just supply a field substitute as the delimiter fields html/description text. Please see the below tutorial for substitution usage information.

www.joomlapolis.com/support/tutorials/107-use-cases/18353-using-substitutions-throughout-cb