Block All Google Drive Sharing Except with Staff OU

We are a K-12 school district. We are trying to restrict a specific OU from sharing Google Drive files externally as well as internally EXCEPT with the Staff OU. So basically, this restricted students OU should not be able to share with anyone except the Staff OU. We’ve set trust rules to block all sharing, but there doesn’t seem to be a way to block all sharing, externally and internally, but still allow sharing to the Staff OU.