Creating two levels of workset for a role in EP

Hi,

I have a scenario where we have a role called "Functions".To this role we have attached the workset called Sales,Finance,IT.Below is the structure that is to be implemented.

Functions
       --------->IT
                  ------->Team 1
                  ------->Team 2
       --------->Finance

When a IT person logs in he should not be able to view the worksets (Finance and sales).Kindly provide us input regarding this 3 level of navigation.

Regards,

Dan.