How can I ensure a person has access only to a specific segments and not everything?
You will want to ensure they are added to a 'managed employee' access control group which dictates anyone in this group will only have access to their reporting line or any specific segments they have access to. The 'all employees' access control groups will give a manager access to company wide data, which you want to avoid if you need a user to have access only to a certain group of employees.
Note: Alternatively, you can also set up access for users to specific Workday Peakon Employee Voice (WPEV) question sets, drivers, or segments that have direct relevance to their roles, together with organization-wide survey data.
Example: Your French regional D&I manager, who is also a line manager for a team, can display their team access in one context and display the D&I data for France only in a new access by segment context.
To learn more, see: Set Up Access By Segment for Users