Hi,

Unless you've already found a way to achieve your aim, here is some information on permissions options you have:

Starting with Permissions overview article - you can see the overview of all possibilities and usage.
At devnet.kentico.com/docs/5_5r2/devguide/document_permissions.htm you can find info about Permissions for document types.

So, in your case, both roles will not have the read permission (or any other) for the Content module (all content). Then, the role with access to the document or blog types will have the read/create permissions for given document types.
Together with enabling "Check permissions" setting in your web parts (listings - like repeater or so) you can achieve your aim.
Please note - you will need to enable at least the "Read" permission for other document types for both roles (those doctypes they should see), so they could see other documents.

The exclusion rather than the above mentioned additive approach is available with Document-level permissions, it can be used e.g. in specific scope (path) and allows to deny any of the Read/Write/... permissions.

It's up to you now to select what option(s) best suit(s) your aims.

Regards
Zdenek.