Restricting list of records returned in the Affected Person field to those in reporting structure

Summary:

We are trying to restrict the list of employees returned in the Affected Person field to only the user's direct and indirect report. We've been able to restrict it to business unit using data security policies, but this is too wide a pool of employees. Is there a way of restricting this please?

Content (please ensure you mask any confidential information):

Version (include the version you are using, if applicable):

23D

Code Snippet (add any code snippets that support your topic, if applicable):