Grafana v6.3.5, Prometheus 2.15.0, Kubernetes 1.16.10

In Kubernetes cluster, namespaces "teamA" and "teamB" (and "admin") Users of each namespace can only access resources in their own namespace, they have no knowledge of anything outside.

Prometheus instance running in separate "admin" namespace, scraping everything in cluster, as well as an admin-access Grafana instance which has dashboards showing all namespaces metrics.

I want to provide both teams their own "local" Grafana, so they can customize own dashboards, alerts etc. They each have own Grafana pod running in their namespace, and with datasource "admin" Prometheus. However because both use "admin" prometheus datasource, there are no restrictions in metrics data access, and both teams can query for other team's metrics (and hence pod, container names, counts, histories, etc), eg in dashboard JSON change "regex": "teamA" to "teamB"

How set up so each team's local grafana can only see metrics data for their own namespace?

Need to create seperate prometheus for scraping each namespace only? and have each team's Grafana source data from here? (also lock down the admin prometheus access?) Use a single grafana, but provide different (non-admin) log-ins per team, with different roles restricted to different metrics?