You can separate accesses to data using different indexers in the Cluster giving different permissions top them. In this way you have a linear infrastructure with one Cluster mstr that manage all the Indexers and a Search Head (eventually clustered!) that access all the indexes in all the Indexers.