Should be possible.
Read this for guidance.
viewtopic.php?t=182340
Once you have your three configs done and are running into issues,
-post all three here and will have a look.
-include a network diagram as well.
-provide user requirements, what each user/device, groups of users/devices, admin should be able to do and not be able to do.
With the above information,, it wont take long to resolve any outstanding issues.