Combination of Update and View Only access in HCM Cloud

Content

Is this possible?   (In EBS-speak, this would be the equivalent of 2 responsibilities):

User has update privileges (like an HR Specialist) for a certain population (Department A)
AND
User has view only privileges for a different population (Department B, C, D)

Do the data roles need to be distinct enough so that a user only has update or view only to a particular department or can the update privileges override the view only privileges?

Ex.

Update (Department A)
View Only (whole company)

Or must it be:

Update (Department A)
View Only (Department B, C, D)

I am guessing the latter - meaning that for each department, the user either has update or View Only.  This makes the security maintenance a bit more cumbersome, but still manageable.