About user and device policies
You can let some people in your organization use a feature or service in their Google Account, but not others. For example, you might turn on Google Hangouts only for your support team. Or you might let only the sales department share public calendars. You can also tailor settings for different Chrome devices. Just group users or devices that have specific requirements into organizational units. Then apply your desired settings to each of those units.
You can apply policies to:
For example, to turn on Hangouts only for your support team, create an organizational unit containing your support users. Then turn on Hangouts for just that organization.
Most services have individual settings you can apply to organizational units. To allow only your sales department to share calendars publicly, for example, create an organizational unit containing your sales team. Then in your Calendars settings, enable public sharing for just that organization.
You can add Chrome devices to organizational units, too. For example, to let teachers use Incognito mode on their Chromebook but not students, create an organizational unit containing the teachers' Chromebooks. Then in your Devices settings, turn on Incognito mode for just that organization.
Next steps: Learn how the organizational structure works