Organisation & UserGroups

Organization drives your visibility and user group drivers your permissions on the entities.

Considering the use case that a user from one organization should not be added to another , Thingworx do not have internal restrictions by itself.

But i am not sure exactly what is the final target. But yes you have to manage through services.

Also you can use below services to check if the user exist in the unit.
var params = {
name: "unitname" /* STRING */,
member: "username" /* STRING */
};

// result: INFOTABLE dataShape: EntityReferenceWithDescription
var result = Organizations["TestOrganization"].GetMember(params);

var params = {
name: "unitname" /* STRING */
};

// result: INFOTABLE dataShape: EntityReferenceWithDescription
var result = Organizations["TestOrganization"].GetMembers(params);