Hi Sven,
the rights of a role can’t be restricted to a group of servers, services or sites. All rights assigned by a role always apply to all hosts/services that the user can see in the CMK. It’s not possible to give a user edit rights to one group of servers and read only rights to another group of servers.
At least that’s what I understood. Would be happy of course if it is not so because we have the same problem (CME Edition) 
Regards, Lars