Is there another way to limit user access to PO and AP Invoice transactions without having to create

a separate BU in the enterprise?

The implementation design is to have multiple departments from the same legal entity create POs and Invoice transactions in a single Business Unit. However, one department/division operates as a separate legal entity. That department's purchases, invoices, payments are independent from the rest of the company and no other department should be able to view the PO/AP Invoice transactions in Oracle Cloud. Is there any other way to achieve that status other than creating a separate Business Unit for that department/division?