What's the best approach of having multiple test environments next to production one?

We have multiple programming teams that build solutions that use Active Directory very often. We have tried different approaches, starting with their own domain controllers (in same subnet), or additional OU's in our production AD that the team gets control over and can create/delete accounts within that one OU.

We thought of possible 4 solutions:

1. Setting up separate OU's in ou production env.
2. Creating subdomains for our contoso.com domain like test.contoso.com, something.contoso.com and delegating control to the teams (would we need additional DC's or the two that we have already would be enough to hold this?
3. Setting up additional test domain controler that has a trust to our main domain and all teams can use the test domain controler as they please.
4. Setting up single domain controller for every team/project.

We're taking in consideration amount of resources needed, security (for example having multiple domain controlers with multiple passwords may lead users to use simpler passwords) and overall best practices for this scenario.