To hide AD objects or Business Units from users, you can use the built-in Blind User Role.
1. Open the Blind User Role (Your service / Configuration / Security Roles / Builtin).
2. Click Add Assignment above the Assignments section.
3. Select users or groups, from which you want to hide specific objects. Click OK.
4. Select the AD objects or Business Units you want to hide for the users you have selected, click Add and click OK. Save the changes made to the Role.