If you don't want Employees messing with the line level departments, just hide the column. Use an afterSubmit trigger on a UE script, or a clientScript, to populate the values on all the lines.