That is what "apply to all subworkspaces" does. If you go to a user's permissions, click on the 'company' workspace, set the permissions you like for 'company' (maybe just click the "All" checkbox), now if you click on "Apply these permissions to all subworkspaces " you will apply that same permissions that you defined to 'company' to 'state 1', 'state 2', 'city 1', etc.