Thanks for the response @clever-art-10420. Unfortunately, I don't think that the separate app route will work for me, practically speaking, as it would mean setting up and maintaining way too many separate apps. Alternatively, I could set up hundreds of different roles, but that would leave me with the same problem.
I think the best I may be able to do is to make the roles apply to the navigation items only, so that each user is able to access the navigation with their broadest applicable role, and then use record based permissions to show and hide fields.