Hi,
As far as I am aware, the IT department can do exactly that, create a group policy for those users at the server end, and by adding those users to the group policy, they will have the ability....
That system has been around for years under Windows Domain Servers and I assume it still is.
After all, the idea of having thse group policies, is to do exactly what you are asking.
So to answer the question, yes it can definitely be done.
Kind regards
Rossco