Three access packages needed.
* Members of Group3 must be able to request access to Site1 only. [One access package for Site1 named X1]
* Members of Group1 must be able to request access to Site1 and Team1. [One access package for Site1 and Team1 named X2]
* Members of Group4 must be able to request access to Site1 and Team1. [One access package for Site1 and Team1 named X3]
* Only members of Group2 must be able to approve access package requests from Group1 members. [Add Group2 as approver for X2]
* Only members of Group5 must be able to approve access package requests from Group3 and Group4 members. [Add Group5 as approver for X1 and for X3] Reference:
https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-package- first