What I would strongly suggest is that you don’t re-use the is_superuser and is_staff flags for your own application. My advice is to leave them alone for their originally intended purpose - controlling access to the admin.
Use the Django Group and Permission models for this purposes. Create Groups for Superuser, Staff, etc.
Assign appropriate permissions to each of those groups, and implement your view-level security accordingly.
See the thread at How to create Workspaces and manage them for all the users in Django? for a recent conversation of this type of topic.
For the solutions you propose, I’m more in favor of #2.