Help me understanding the schema

was there any better documentation (with pictures ^^) than this: http://www.postgresql.org/docs/current/static/ddl-schemas.html

so, here's my current statement, if someone kind enough to correct me, please tell me if its right or wrong:

1. one database may contain many schema

2. one schema may contain many objects (tables, functions, etc)

3. multiple user can connect to single database

4. when the schema not defined on queries, it's always search from public schema

5. tables created on schema x, can be joined using query on other schema

6. schema are related to database not the user, so, if we create a schema, it shows on others user as well that having access to that database?
7. we can set the privilege of user x for schema y

  ie. database aaa contains schema a1, a2 and a3. user xx can query from schema a1 only, user yy can query from schema a2 only?

8. tables on one schema not related to other schema? it means when i create table on schema x, it won't show on schema y..

9. so the best practice of database security is:

 - create multiple schema, only relate schema to required user, eg. finance schema can only be accessed by finance people, humanresource schema can only be accessed by humanresource people..

 - do not allow queries/manipulation from users, always use views for queries/stored-procedure for manipulation/trigger for data integrity or protection and set the privilege to specific user?

 - on web application, set the running user (of the CGI process) to sameuser login type, so we don't need to store any password on file.