Disable Grant Access Using Hierarchies, Create a criteria-based Sharing Rule for the HR Department, and Remove Review Read permission from non-HR profiles. These are correct because disabling Grant Access Using Hierarchies prevents users above the record owner in the role hierarchy from viewing the Review records, creating a criteria-based Sharing Rule for the HR Department allows users in that group to view all Review records, and removing Review Read permission from non-HR profiles prevents users in other profiles from viewing any Review records.