How to restrict a custom role to receive PO for a particular business unit?

Summary:

We have created a Custom role which Allows creation of self-service receipts by any other person apart from the requisition requester or preparer and we want to restrict this role by Business unit.

I have created a data security policy which I used Data Set as Select by Key and provided the BU that it would be used.

But upon granting this role to a user, he is able to receive PO from all other users for other BU not specified in the Data security policy.

Content (please ensure you mask any confidential information):

Version (include the version you are using, if applicable):