Satellite 6.x Host groups/collections for different departments

I'm going round in circles trying to implement something relatively straightforward; I have several departments (~25) which ideally, should only be able to manage their own hosts which have been registered/activated using their own seperate activation key.
- There is no permission/role/filter which can be set which allows me to do this. ?
- Should I be using different organisations, having looked at this, it looks like I need to generate 25 odd manifests to import into RHS, then setup another 25 Libraries and environments for each organisation... really?
Does anyone have any hints as to how they have implemented their Satellite setup to achieve something similar?