Admin1 has a only the permissions on Department1 administrative unit.
User3 and User4 are not assigned to Department1, so Admin1 has no permissions to reset passwords.
Adding a group to an administrative unit brings the group itself into the management scope of the administrative unit, but not the members of the group. In other words, an administrator scoped to the administrative unit can manage properties of the group, such as group name or membership, but they cannot manage properties of the users or devices within that group (unless those users and devices are separately added as members of the administrative unit).

Group3 is not assigned to Department1.

Admin3 has permissions for the entire Directory.