Multi-tenancy for a HDP IaaS cluster on Azure using ADLS as a storage layer

[#1]

What is the best approach for multi-tenancy from authorization point of view under the following scenario

Within the same company, there are 3 different groups which are not allowed to see each other's data that is stored in multiple folders under the same ADLS storage account.

I know we can use Ranger to control Hive external tables access but what about access to files on ADLS? and also if they are trying to run spark workloads accessing the data directly from ADLS, what kind of authorization we can apply on HDP?