Report Manager and Security

 After playing around with this for several weeks I am at a loss.  The requirement that we have is, I am sure, very common.  We want to have the ability to secure certain reports by company and department. An example would be that OU1 has company values 01 through 10.  We simply want to PE on company and PE on department.  We really only want to have security on department so that department heads can only see the data that they are allowed to see.
So, for example, the IT manager would be able to view a report for each company and for his department, 100 say.  Ideally that would mean that the expansion value would have the following values: