I think the trick may be to separate the HR department into it's own separate ou, and then the rest of the company into another ou. Then give them admin rights to the within the rest of the company network, but only allow yourself or the head of HR (or a computer saavy HR person) to have admin rights to the HR ou.