Here are some answers for you.
Placement is controlled via Placement Profiles, these are ruby methods that would contain logic to do what you wish. OOTB you can use tags to simply tag up the various infrastructure components into their various categories as you see fit, the visibility of those items are automatically controlled via RBAC. So if you tag certain clusters as RED, and login with a User/Group that is only allowed to see RED then MIQ will only offer those resources that are tagged as RED to the user. If you wish to do this automatically, then this can work just as easily by selecting the “Choose Automatically” setting the in provisioning phases.
The same answer is for Networks too, you decide the logic, then write a provisioning profile that massages the current deployment options to what your logic decides. Everything is stored into an object call miq_request, and easily overridden.
Adding to an OU would be something MIQ could do with some automate method, I am sure this has been done before, though adding to a domain really sits with the OS itself to do using sysprep or unatttend.xml. We can call powershell, ruby and anything else you load onto the MIQ Appliance.
Approval is easy too, just amend the validate_request approval method for the approval workflow, and add some code that checks the users AD group and either auto approve or request approval. I am pretty sure this is less than 5 lines of ruby, not a challenge!
Costing should be possible base don your requirements, you may need to tag the departments and report on the tag, but consolidation of report data by groups is possible.
Hope this helps