First of all in order to be able to create an EFS file system, you need to have Allow permissions to a series of actions like CreateFileSystem and CreateMountTarget ( among others)

IAM policies can be used to control who can administer the file system.

Security groups control network traffic that is allowed to reach the file system ( remember that Security Group act like a firewall) therefore are usefule to control control what NFS clients that can access your file system ( inbound rule of type NFS with a source either the security group of your instances or their IPs)

You can control who can have access to what files and directories with POSIX-compliant user and group-level permissions.