Hi Kelly,
Each business unit have a default team, you can have more than one team per business unit.
You can also set the security role of a Team as "User" level, and only the users of that team will be able to have access to that record.
Please, be aware that, in this scenario, the Team should be the owner of the record, so the users present in that Team will have access to the record.
In addition, it's also important to validate that Security Roles are cumulative and even if a user have a security role that is inherit from a Team, he also have their own security roles.
If you have a sharing team, this one, does not have Security Roles, but other users can share records with the team, so the users that belong to that team can view.
You can take a look in this documentation about Teams (owning and sharing): docs.microsoft.com/.../use-access-teams-owner-teams-collaborate-share-information
There's a lot of factors that play into security, like what records should the users have access or if we will need owning or access teams. So, I am not aware of all of your requirements.
A best practice is to make a security planning and keep it simple.
I hope this information it helps.