Create a database security officer and database administrator

Log in as administrator (ADMIN) and create a Database Administrator (DBA) with the minimum security label:
SYSTEM.ADMIN(ADMIN)=> CREATE USER dba PASSWORD 'dddd' SECURITY LABEL '::';
CREATE USER
SYSTEM.ADMIN(ADMIN)=> GRANT CREATE DATABASE to dba;
GRANT

The DBA is not able to see any data above 'PUBLIC::' even in tables that they create.

As administrator, create a Database Security Officer (DSO) with the minimum security label. Giving Manage Security permission allows the DSO to change their setting.
SYSTEM.ADMIN(ADMIN)=> CREATE USER dso PASSWORD 'dddd' SECURITY LABEL '::';
CREATE USER
SYSTEM.ADMIN(ADMIN)=> GRANT MANAGE SECURITY to dso;
GRANT
SYSTEM.ADMIN(ADMIN)=> GRANT CREATE USER to dso;
GRANT
SYSTEM.ADMIN(ADMIN)=> GRANT LIST ON dba to dso;
GRANT