In that case you may be better served by using a Security Tag to restrict access to specific documents that sit alongside documents that are openly available. Security is applied at the folder level. It can be applied to documents, but that gets very ugly, very fast. A Security Tag let's you pick out a single document and hide it fairly efficiently.

Remember that TRM isn't a feature, but is a technique for using features. So, you're still bound by all the normal rules for security. Generally, the implementation of TRM is in the form of restricting the visibility of your Records, but exposing the documents in a way that makes sense. You would not give your users permissions to see into the Records series' by denying browse permissions. Then you create shortcuts into an area that they can see, in a folder structure that makes sense for their use case. Your Records structure might not make sense to the average clerk because it needs to be organized by document type and retention. However, you create a folder structure with shortcuts that's organized by name for the regular users to see. That's what is meant by secure tunneling, that you're allowing people visibility into a more secure section of the repository.