Steve, I think the best way forward towards a solution for you is to link the Data Island table AdHocMetrics to your SA user definitions. You won't have to change anything else in your document, just link the allowed metrics to the User definitions in SA. Data reduction will do the rest.
In essence, it boils down to the following steps:
Add another link field to your SA table that either identifies the current user, or - if groups of users should be able to see the same set of metrics - the user group. Let's select the latter and define three groups: MNGMNT, DPTHEAD, EMP. Note that you will be able to define users to belong to multiple groups, but the group with the large metrics set will prevail.
In Section Application, create a table that maps each user group to a range of metrics. The table has two fields: first one is the new field from the SA table, second one is the first field from your AdHocMetrics table.
Add all connections in this table, either from an external file to be able to experiment with the assignments, or INLINE if everything is fixed.
I'm guessing that this is how the logic is implemented in Sasi k's example, but I don't have access to the hidden script so I can't verify.
Many thanks for all your help and comments. The section access I currently have in place has been deemed sufficient, and restricting access by the %Metrics is no longer necessary so please count this as closed. No further help is required.