You need to configure the Employees roles so that users can query only sales orders for their respective sales territory