Workspaces/Partitions for a Global Enterprise of Users

We're in the process of deploying Marketo across our global organization and are determining how best to setup our environment that reflects how we are organized (mainly for reporting) but also to ensure we are compliant with our strict data policies (especially in Europe).  We have three area marketing teams: NA, APAC, and Europe.  Our thought was to define a lead partition for each country (especially important for European countries) and then three workspaces that would contain the appropriate lead partitions (US and Canada would be part of the the NA workspace).  But what's unclear is whether we can also define user roles that would restrict access to specific lead partitions.  For example, the marketers in France would have access to the Europe worspace, but only the France lead partition.  Is this possible?  Any advice/guidance from others who have deployed Marketo across a global enterprise would be very helpful.  Thanks!