Hi, Rich072
Hmm, you could create a Custom role instead of Billing Reader or Reader and deploy that custom role to Management Groups 2 and 3 - theoretically, that means anyone in the custom role shouldn't be able to see any resources or cost analysis for the other management groups.
Actually, Try to assign the Cost Management Reader role, at the management group 2 and 3 and test. That user should only be able to see the subscriptions within those 2 management groups.
If that fails to work, you can try a custom role, without the: Microsoft.Management/managementGroups/read
Anyone with Owner, Contributor rights at a higher level will still continue to see everything.