Set AllowFiltering="true" (allowFiltering in React) and the grid's toolbar gets a Filter button, which opens the view's own filters in the FetchXML query builder for the user to change. Anything FetchXML can filter by can be built: conditions on the table's columns, grouped with AND and OR, compared with a value or with another column, and related tables — whether a related record exists, or one matching conditions of its own. Only the columns and related tables the user may read are offered, and the server refuses a filter on anything else. The user's filters last while the grid shows the view: another view starts from its own.
Press the Filter button on the toolbar. The dialog opens on the filters of the view the grid shows. All Contacts has none of its own — the contact table's row security already keeps every query to the contacts you may read — so it opens empty, ready for yours. Contacts at Companies with a City keeps those whose company has a city, through a related table with a condition of its own. Change them, press Apply, and the grid shows the rows that match from the first page, its Filter button filled to show the filters are yours. Things to try:
Contacts of Active Owners keeps the contacts whose owner's user account is enabled, through a related table — system users — that the demo gives its visitors no access to. Rather than show every contact (the filter left out) or none (the related table matching no rows), the grid says which table it can't filter on, so the developer can give the users access to it or change the view. Open the Filter dialog and take the owner away to see the rows: the dialog shows the view's related table, but offers no system users to add. An internal user signed in to the demo, whose own Dataverse security roles decide what they read, sees the rows.