Restrict users to viewing only data in their state?
Seems like CiviCRM ACL might be your answer.

https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/

Native CiviCRM ACLs give more fine grained control, so, for example, you can limit access to view, edit, create, delete and search to :

groups of contacts
a profile (this is a collection of existing and/or custom fields, see "Profiles")
a set of custom fields
events (e.g. a user may access one event, but not others)