Can't really do what you want. If you want to break groups up like that then you need to use the Organization structure.
That said, if all you want to do is protect some operations you could use the AMQP blocking tasks to add you own protection in. (For example if you detect a deployment is going to the wrong VDC you can stop with an error). This is far from perfect, but might work based on the need.