Limit all results based on a trusted extension 'fact'

[Mantene]

So, our organization is using a trusted extension fact to split out different 'management groups', each of which basically has their own set of puppet-controlled vms. Is there a way to restrict all results to objects with trusted.extensions.mgmt_group = "IAM", for example?
Ideally, I would like to set this up so that different docker containers of puppetboard can be run, one for each mgmt_group, accessible only to people in that group (access would be controlled by our reverse proxy). Thanks.