Altiris Managment security (lock down diffrent areas of AD OU)

Hi

I am having problems trying to work out the best way to prevent security groups from deploying or interfering with different areas of the business they are not responsible for.

 For example I would like Helpdesk roll to be able to deploy and manage the UK side for desktops only and not servers.

On the over hand I also like to create a roll that Poland can only deploy to Poland servers and desk tops but not touch anything with in the AD group of UK.

We have many more areas of the business but cannot find a way to prevent them from doing things out side of the responsibility.

Could someone link me to a document or let me know of a way to do this?

Thanks