The current implementation does not allow multiple file plans within the same site. Supplemental marketing work at any level in the file plan, however you probably don't need these.
RM "admin featrures" are implemented through Roles, with some 50 different admin capabilites being grouped into 4 roles. These roles come pre-defined but you can alter them or define your own.
The permissions model in RM is such that people cannot see things unless they are specifically given read access. You should be able to use a combination of these two things to achieve what you are after since most of the capabilities require you to have write/filing access to the fileplan where you are trying to carry out the operation.
Taking some examples:
Suppose you have the capability "Create, Modify, Destroy Folders", you will only be able to create folders in parts of the file plan where you have write/file access. If you have only read access to a Category you would not be able to create a folder within that category. If you had neither read/write to the category you would not be able to see that category.
The same is true for other capabilities such as: Move Records, Close Folders, Change or Delete References, Freeze Records (this is just a sample).
There are some capabilities which are by their nature system wide and don't act directly on the file plan, a user with this capability can obviously use it without recourse to file plan permissions. An example of this type of capability are any of the Audit control capabilities such as Declare Audit as Record,other examples are Create, Modify, Destroy Users and Groups and Map Email Metadata.
Hope this helps you define your security model.
Carlos