AMA: Your guide to adopting Microsoft Intune

Currently my organization is planning to use Intune with a distributed RBAC model. My team will provision access for other groups or departments who want to use Intune for managing their own devices. The problem that we foresee is with group management. If someone from one of these departments wants to assign apps or policies to smaller subsets of their scope group, they will need the ability to configure scope groups for their own role assignment. What is the best way to accomplish this without granting them the Intune Administrator role? We considered using device categories, but creating those requires the Intune Admin or Global Admin role.