Before a device is enrolled, there is no inventory item for the Mac to assign a department to. You would need to wait until AFTER a device has been enrolled to assign a department. Have you considered using network segments instead? Setup the network ranges for the given departments and scope software that way.
If your users are LDAP users, you can set exclusions to policies based on AD group membership. Set the policy to target all devices and users, and set an exclusion for the LDAP group you want to use for people to see the software.
I recommend installing as little software as possible during enrollment. Set any nonessential software to install after the first check in, or let it be self-serviced.
Sites are also a thing, but that function of JAMF is way under developed.
