How to structure sharing between manager and employees?

When testing AdobeSign I was under the impression group admins could see the documents of other non-admin group members. This is not the case, so we must of unintentionally shared accounts when testing.

Now I need to figure out the best way to share employee accounts with their manager/team, but not with each other.

Is there a way to do this without having to have each user go in and share their account? Also, is there a way to enforce the sharing so the end user can't remove it?