Users X and Y need to see the same candidate record.

Use a custom Visualforce page to make the email address visible to user X but not user Y

Use a sharing rule to make the email address only visible to user X

use page layouts to make the email address visible to user X but not user Y

Use field-level security to make the email address visible to user X but not user Y