So I am trying to limit a role to be able to see and approve purchase orders / expense reports only for themselves and their team. The problem is when I give them the relevant permission they can see ALL PO's / expense reports. Any best practice for this?

Have you made adjustments to the user role? I believe you can set Employee restrictions to "Own and Subordinates Only" - and you can also lock down the subsidiary in the role if that helps with further partitioning. Just make sure not to allow cross subsidiary record viewing.