Your organization has recently migrated to Google Workspace and you are tasked with setting up Google Drive for sensitive project files. The goal is to restrict access to files only to specific departments, while also allowing project managers to control sharing settings within their own teams. Which of the following approaches should you take to accomplish this?