Domains, Organizing Sites, and Service

Not necessarily looking for an answer (though I have looked and would gladly take one). But some help pointing to the right documentation and concepts would also be appreciated. I have a background in Plesk, but I think some of my confusion is that I am one layer lower than I might have been used to there (? maybe its just the UI in CPANEL seems to really overlap) Here's the thing, trying to suss out the differences between main domain, domain, subdomain, and addon domain and how to best organize my users, their sites, and access and domains. My company recently subscribed to a CPANEL service with the idea that each department would get its own isolated slice of the web and we could keep them separated, so I am trying to think of the differences between those things and how to keep them in isolation from each other, so if HR does something silly and gets hacked it is in isolation from the finance department's Wordpress site. Each with its own doc root would be nice as well as the folks in accounting are wildcards and tend to bring out the worst in any tech they touch. We have the main domain (not sure the importance of that either). I do not have access to WHM. so, eg., hr.web.example.com finance.web.example.com acctspayable.web.example.com legal.web.example.com Each with its own users and each web site running in isolation (and while I would, of course, take a well thought out answer, direction to equally useful and nuanced documentation would also be appreciated). And I just can't seem to wrap my head around what I need and what I see (without it feeling kludgy) Any help greatly appreciated. Thanks