Data visibility based on user role

We have to introduce a new set of users to system. Those user belong to region and whatever data they create, they want to keep it confidential. They want to see and use existing data throughout the application but data created by them shouldn't be visible to anyone except their own group. We don't have any restriction of data visiblity in system as of now. All users can see data through "Default Organization"

New users want to use Opportunities, Account, Contact, ACtivties, Call report etc.

We thought few approaches like-

1. Creating separate BU- This way they get the data restriction but they can't see default org data. if we give all org view to new users, UI may get resolved but other areas like workflows, business services etc will query on business layer. So other Org data will be ignored by Buscomp most likely. Also BIP reports. Async workflows may get impacted.