One would this the best solution for this would be a Federated structure that would ensure a Chinese Systems administrator could only deal with whatever resources assigned (China maybe) and a US administrator can only work with whatever resources are assigned (U.S customers??). Therefore you can have the separation of data but please everyone.

I am not saying it would be simple to iron out, but it would allow for distrusting customers to all play together without worrying about data compromise.

Just a thought, i read all the comments and they are about politics and such and very few are about a technical solution to work for all.

One can argue only letting a Chinese Administrator work on a subset is again a geopolitical thing, but that point should be moot if other administrators are restricted as well.