Once you partition all your collections and assign a new Admin user to their own groupId, any new users they create, or any documents created by any user will automatically inherit the same groupId, and any search or update of documents are restricted to documents in the same groupId.