About user and device policies
You can let some people in your organization use a feature or service in their managed Google account, but not others. For example, if you're a G Suite administrator, you might turn on Google Hangouts only for your support team, or you might let only the sales department share public calendars. You can also tailor settings for different Chrome devices. Just group users or devices that have specific requirements into organizational units. Then apply your desired settings to each of those units.
You can apply policies to:
For example, if you're a G Suite admin, you can turn on Hangouts only for your support team by creating an organizational unit containing support users. You can then turn on Hangouts just for that organization.
Most services have individual settings you can apply to organizational units. For example, if you're a G Suite admin, you can allow only your sales department to share calendars publicly by creating an organizational unit containing your sales team. You can then enable public sharing just for that organization in your Calendar settings.
You can add Chrome devices to organizational units, too. For example, to let teachers use Incognito mode on their Chromebook but not students, create an organizational unit containing the teachers' Chromebooks. Then in your Devices settings, turn on Incognito mode for just that organization.
Next steps: Learn how the organizational structure works