The only possibility for this is to use workspaces and partitions, which may have a cost. Once you have this option set up you can have the users restricted to some workspaces, which themselves will have only access to some of the partitions.
WS/LP can work in the right circumstances, such as Customer vs. Lead data or regional breakdowns. Marketo isn't setup well for this type of lockdown, so it's a good Idea to post.
However, you can do some more work with Roles
- No Lead View
- No Lead Database, or limited DB.
- No Smart Lists
- No Analytics (although which report shows Email Address?? The Web Activity one?)