Hi Downunder,
The way to go about this would be to use Business Units within CRM. You can then give the users a security role which only contains read/write/create at a Business Unit level. This will stop them from seeing data owned by a user outside of their own Business
Unit.
The following blog should help you in understanding the use of Business Units in conjunction with Security Roles.
http://www.powerobjects.com/blog/2014/02/14/microsoft-dynamics-crm-2013-business-units-and-data-silos/
If you need help with setting up the security model let me know.
~ Atomic Coder