Something like following should work for your scenario.

CREATE FUNCTION mask_email_tiered(value STRING) RETURN STRING

  RETURN CASE

    WHEN IS_MEMBER('admin') THEN value                    -- Full access

    WHEN IS_MEMBER('da_email') THEN value                 -- Full access

    WHEN IS_MEMBER('analyst') THEN CONCAT('***@', SPLIT(value, '@')[1])  -- Domain only

    ELSE 'xxx@xxx.com'                                    -- Masked

  END;