We have a traditional setup where IT owns the Okta org and all admin functions. We'd like to integrate our Okta directory with some cloud infrastructure services and grant access to users via specific groups that a different team manages - however, we also want to prevent the chance of a compromise of our IT team being used to move sideways into these other cloud infrastructure services. In other words, prevent IT from unilaterally adding users to our groups controlling access in these 3rd party systems.

Is the only solution to have a completely separate Okta organisation that we manage ourselves, or is there another way to do this within the one Okta organisation?