Users automatically see their own deployments.
Support Users in a business group can see all deployments of all users in that business group. Whether they can see Day-2 actions depends on how the entitlements are configured.
As you put all departments into the same business group you cannot prevent Support Users from one department from seeing deployments belonging to another department, but they can be prevented from seeing Day-2 actions as mentioned.
Ideally if you want the departments to be completed isolated, using native vRA functionality, you will need to give them separate business groups.
Unless I'm misunderstanding the question?
