Security at dashboard level vs workspace

Yes, you can give users access to individual reports within a workspace, but the best practice is what R1k91 linked to. It is not possible to nest workspaces.

I've seen some organizations have departmental workspaces and then an executive workspace with more sensitive data.