B2B guest permissions on security groups to tie down guests inviting guests

Hi,

Is it possible to have guests be able to add additional guests only to a security group that they are a member of, but be blocked from adding them to other security groups within the same Azure AD?

Some detail. We have a number of subscriptions on a single Azure AD. We want to publish apps to these separate subscriptions, and allow external support companies to access their respective subscription for troubleshooting, should any problems arise. We want each external company to also be able to invite guests in from their own company as well (so one person from each external support company will be in charge of inviting in their colleagues, without us having to have any interaction).

We have created a number of security groups, one for each external company. However, when we invite one in as a guest, and use a dynamic rule to add them to their respective security group, they can invite guests in and then add them to not only the group that they are a member and owner of, but also to other security groups which they are neither owners nor members of, which is a security issue for us. We have confirmed this happens whether or not the guest is a member of the RBAC group "Guest Inviter". At the moment they do not have any special permissions other than what they are provided as guests.

Right now it appears the only way to do this is to have separate Azure AD's for each subscription, but we would rather keep our single Azure AD and add subscriptions per customer as necessary then publish our app to that subscription, create a security group for each subscription or app, invite the 3rd party support rep in, then leave them to it to invite additional colleagues as required so they can work on any issues with the app by themselves, without involving us. Is this scenario possible?

Thanks,