Security based on user location (AP Invoices)

Summary:

We have a requirement to create a role to limit access to all employee expense report invoices. Currently we have only one business unit, which by default gives access to all invoices within that BU including all employee expense report invoices. Is there a way to configure a role that would be location based, i.e provide access based on location rather than BU? or any other ideas on what attribute could be used?

Thanks a lot!!

Content (please ensure you mask any confidential information):

Version (include the version you are using, if applicable):

Code Snippet (add any code snippets that support your topic, if applicable):