Azure Subscriptions are the right choice for the company as they form the container for billing, access control, and resource allocation. Each department can have its own subscription, with the costs separated per subscription. Management groups are not the answer as they are used to manage access, policies, and compliance across multiple subscriptions, rather than separating the billing and access control for different departments. A single subscription with multiple resource groups would not ideally segregate the billing by department. While Azure Active Directory performs identity and access management, it doesn't separate resources and billing at the departmental level.