Do I have to allocate more than one permission set to my users?

It is entirely up to you. You can create one default permission set with a subset of resources that all your users are entitled to use, and which will be allocated to all your users. You can then create additional permission sets which have limited entitlement. Using this model, the majority of your users would be allocated just one permission set (the default), and a smaller number of users would have access to two (the default and the limited entitlement).

Alternatively, if you wanted to use a model where all users only have access to one permission set, then you should create one permission set with access to everything except, for example, EMOL medical-restrict, and then a second permission set with access to everything including EMOL medical-restrict. You can then allocate the permission sets according to the users entitlement.