In our company we have users who need different levels of attachment access, how can I set this up in OWA?

If you are using Microsoft ISA 2004 or ISA 2006 to publish OWA you can set up Forms-based Authentication (FBA) to configure different attachment access for Public and Private connections. If you are not using ISA, you will need to look at a third-party add-on such as Messageware AttachView (www.messageware.com). AttachView gives Exchange Administrators the ability to customize security settings by IP address, user groups, or corporate device recognition, controlling the user's ability to view, open, print and save documents.