You can create an event handler that will break file permission inheritance and change the permissions you require.
Another option is to move the file to a folder (or even separate document library) that is pre-configured with the permissions you want.
The first option is simpler to implement, but the security management can become... messy.
Here is some code to get you started on breaking and setting document permissions.
public string ItemPermission(string SitePath)
{
string ReturnVal = "";
try
{
SPSite WebApp = new SPSite(SitePath);
SPWeb Site = WebApp.OpenWeb();
SPList list = Site.Lists["TestDocLib"];
SPListItem item = list.Items[0];
SPRoleDefinition RoleDefinition = Site.RoleDefinitions.GetByType(SPRoleType.Contributor);
SPRoleAssignment RoleAssignment = new SPRoleAssignment("<domain>\\<user>", "email", "name", "notes");
RoleAssignment.RoleDefinitionBindings.Add(RoleDefinition);
if(!item.HasUniqueRoleAssignments)
{
item.BreakRoleInheritance(true);
}
item.RoleAssignments.Add(RoleAssignment);
item.Update();
}
catch (Exception ex)
{
ReturnVal += "Permission not set, reason: " + ex.Message;
}
return ReturnVal;
}