Separating permissions by site/region - constraints or a whole new instance?

[domainzero]

I'm looking in to setting up a team at a different data center (Region and Site) in our instance of Netbox, but want to make sure they can't see or interact with any racks for devices in the existing regions or sites.

I have been trying to set up permission groups with constraints, but it seems like I can't quite get cables, device roles, etc limited just to one region or site via constraints. Is Netbox capable of handling separation like this, or should I look in to spinning them up a new instance in their data center?