Depending on the exact requirements, you can have several solutions and the exact details might be a bit different.
You probably need to look into entity access on the domain model and more specifically at the access rules to the user.
If you have a structure like this
You could restrict access for users for instance based on the association between the account and the department. Eg setting up access on Department based on an xpath
[Module.Person_Department/Module.Person/Module.Person_Account='[%CurrentUser%]']
If you want to flag certain departments, you can either base the acces only on this boolean
And of course you can use a combination of the two.