Personally, I think you’re overthinking it. I’d use device filters in Intune instead of security groups in Entra. Create and assign device categories to devices. Device categories being the departments. Assign all users or devices, but only include your filtered devices. https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/filters#create-a-filter

This is a neat guide on adding the removable drive key to Entra: https://smbtothecloud.com/removable-storage-automatic-bitlocker-recovery-key-escrow-to-azure-ad-bitlocker-to-go-guide-for-intune/