Fine Grained Access Control in 1IM

Using 7.1. I understand I can create permission groups and apply them to users through Application Roles. Couple of questions, do these access controls only affect the 1IM tools or if a user doesn't have access to a particular will they also not be able to view that in the portal? Also, is there a way to make it more fine-grained, to say if a user can only read and update users in a particular role? It seems like the permission group will only let me define this for the entire set of users, not just some subset of users.