Separate tenants are the only option at this exact moment to truly separate logical environments with a "hard" border. Note that you can additionally use process group rules in combination with tagging to logically split apart entities (hosts, process groups, services) based on criteria such as prod vs pre-prod.
Note that it is currently in beta (with a more public beta coming soon) but there is an already announced feature called Management Zones which will allow you to much more easily split different logical groups in your environment and assign permissions and visibility accordingly. They are basically designed to help address situations such as what you described. In combination with what is already available I think this would address your use case better than separate environments.
https://www.dynatrace.com/platform/management-zone...
James
