efficient way to apply content permissions
Have you tried looking into Organic Groups?  It seems like the PERFECT solution to your problem.  It'll require a bit of work to set up, but the benefits will FAR outweigh the work.

You could have each department set up as a group, and then users can be assigned to those groups.  You can then set permissions that allow users to create content but only for their specific group (using OG means that this can be ONE content type).

You'd only need one user role (an organic groups user..you could also have a department admin per department should you want).

You can also do some more awesome stuff from here on out.  Just as an example, these departments could then view their own department content - but you can also display all posts from all groups.

There are some REALLY good videos at Modules Unraveled