Ability to restrict access to ODM data/setup for ODM users

I'm trying to determine if anyone else has been asked this question by a client.  My client has multiple marketing groups in ODM.  They want to restrict access so that one user cannot touch a program they didn't create or a list they didnt' create.  Has anyone run across this and what is/is not possible?  Is it best to get multiple ODM instances setup for the different marketing groups?  

Thank you

• What is / is not possible in ODM from a security / access perspective. 
• Need ability to ensure users cannot access/change other programs, etc
• What is possible in accessing/changing data (contact lists, etc)