Grouping, targeting, and filters: recommendations in Microsoft Intune

Is there a way to prevent a local IT administrator who only manages a subset of the devices enrolled in Intune (based on scope tag) to add all devices/users available in AAD to a security group used in Intune? Similar to how limiting collections work in ConfigMgr.