accesses to data in Splunk are managed at index level, in other words if you want that a group of users be the only that see some data, you have to send these data in one index and give to the group access grants to that index.
It isn't possible to give different grants to different parts of data in the same index.
So you have to send logs from the forwarders that you want to limit to an index (e.g. IndexB), and all the other logs to another index (e.g. IndexA).
than you have to give access to IndexA to User_Group_1 and User_Group_2 and access to IndexB only to User_Group_2.