For organizing multi-level permissions it is possible to configure Restricted Groups in app Configuration.
...
When it is populated configured, user can not see work logged work by other users with another groups membershipthe same group membership only.
Note, Auditors Groups, when configured, allows only users of the selected groups to see time spent by other users, i.e. users of other groups can not see other users timesheet, only their own. Auditors Groups, Auditors Roles and Restricted Groups does not depend on each other, and can be combined to achieve quite sophisticated setup, please see https://docs.google.com/spreadsheets/d/1e9vwV6JJkukQEdJ4WXgZ073IRqUWlx41p1Jkyif0fHE/edit#gid=0 for additional information.