Best practice - Document Library - Variable user access permissions

Being quite new to SP 2013, I would be interested to hear opinions and gain guidance upon the following application scenario.

I want to store HR inbound CV's in a document library. These documents are only to be read by the department head that the applicant is intended for plus HR.

I can only identify two ways to segregate these CV's

1. 
   

   Create a sub-site for each department in the company and allocate perms at the sub-site level. My fear here is setting something up and then with the fluid nature of any business where company structures change, having to merge or split sub-sites. I can also see the need to segregate separate campaigns within a single department with different access lists.

   
   


2. 
   

   Create a single document library with sub-folders for each department and set the perms at the folder level. The downside of this is using folders.

   
   

Or, is there a way of setting document perms with meta data for greater granularity?

I don't see sharing each document individually as an option.

Any feedback appreciated. Thanks.