Some requirements are not clear in your question. The correct answer depends on what your customer wants - If I were you, I would ask the customer about this:
0-What is the difference between a user and an employee?
1-Assuming an employee=user, what if an employee changes departments?
2-Can a group of employees make 1 request?
3-Could an employee belong to more than one department? What about the CEO
4-Is there a subset of employees that are allowed to make requests?
5-What happens to the request when an employee record is deleted (if ever)?
6-Could you delete a request? What happens when the request is delted (make sure you don't delete the employee record by RI)
7-Can the employee make the "same" request more than one time (define the "same")
8-How to handle requests for employees when they leave the company (cancel their requests or delete the requests?)
There may be more questions, but my point is that the solution depends on exact requirements and project scope. Once that is determined the schema can be derived directly. Accordingly both solutions presented may be correct.