I would suggest you create one site collection for each department, if possible, every site having their own permissions. may be you end up two or 3 site collections.
One issue i am seeing may be the URL, i.e now you are accessing sites http://www.abc.com/ but for 2nd or 3rd site collection if you used manged path then it will be like this http://www.abc.com/sites/hr.
You can also think different url for each site collection using host name site collection.
The issue you mentioned.
If you stop inheriting the parent permission in subsite. It just copies the parent permission and display it in subsite. But you can change permission level of the groups available in subsite or add/Remove sharepoint group in subsite, It will not be replicated in the parent site.
But if you Add/Remove users from the sharepoint group in subsite and that sharepoint group was created in parent site then those Add/Remove users changes will be replicated to parent site.
When you break inheritance than you need to remove everybody from permission and add your subsite group in their.