Restrict access to users by domain

It would be a restriction of permissions, then create a Role (user manager, for example) with permission to view profiles and edit profiles, it could have the following options:

Restrict permission to view profiles per domain to user manager Role
Restrict permission to edit profiles per domain to user manager Role
...

The restriction of the domains would be assigned in the profile of "user manager ". If "user manager" is in your profile "xxx.example.com" could only edit domain users "xxx.example.com"

Good thinking, my approach may pose a security risk if the "user manager" can switch to that domain belongs ...

Perhaps a better idea to mark the domain by the administrator, and not those in your profile.

Not if I explain it well, my English is very bad, sorry.