How can the root owner configure this?

A root owner is trying to create an IAM user of the various departments. The owner has created groups for each department, but wants to still delineate the user based on the sub division level. E.g. The two users from different sub departments should be identified separately and have separate permissions. How can the root owner configure this?
A. Create a hierarchy of the IAM users which are separated based on the department
B. Create a nested group
C. Use the paths to separate the users of the same group
D. It is not possible to delineate within a group