I ran some test on a VM and created some groups and added some top-level directories for those groups.
Changed the group on each top-level directories and files below recursively with chown -R.
Set directories to permission 2770 and files to 0660 with chmod -R.
Changed smb.conf and added create mask=0660 and directory mask=2770.
Now new files and directories created on the share have the right permission and belongs to the right group automatically, simply depending on what group the top-level directory belongs to.
If you're not a member of a group, you will not even see the directories or files that belongs to that group.
I think this is a good interim solution without too much work. Then moving to onedrive or whatever can be done in the future on a department to department basis.
Only admin required for adding users is to add them to linux/samba and make sure they become members of the right groups.
It's also very simple to make a separate share out of the top-level folders if you wanted.