When you create a contact you can set permissions for the contact. Both staff, and clients creating sub-contacts. These are not the same as Staff ACLs, but should be sufficient for most cases.
In this screenshot, the "Support" permission is from the Support Manager plugin, so you should be able to accomplish what you want with your Cerberus integration.