Limit contact access to the user's group
For some scenarios it is better to provide the ACL by using Relationships to 'join the dots', rather than using Groups, and this allows you to then create multi-level ACLs.

If someone (X) has Permissioned Relationship to Org 1
and Org 1 has permission to Org 1.1,
and person Y has permission to Org 1.1
and if Org 1.1 has permissioned relationship to Z, then
X will see Y and Z
Y will see Z
Oh, and you don't need to add any ACLs at all, this is taken care of via this Fuzion Extension

May not be quite what you need but may be useful to others who read your ticket and who could switch to having Relationships at the heart of the ACL requirements.