we do the same like @CVQuesty wrote but we additionally use foreman to assign company, department & server_role as "facts" to hosts and these are also part of our hiera lookup config. kinda messy and i wouldn't do it that way again these days. But we didn't know better when we startet (puppet 3.x times). Also didn't had the need to change this system so far as it "just works" and offers enough flexibility to our use case with different teams and their different needs. The only downside is that config for a service might be defined over several hiera layer. Espacially keys with merge or deep merge are nasty to debug 😄