You can use some dynamic sql e.g.
DECLARE @sqlDept VARCHAR(100)='CURRENT_TIMESTAMP';
EXEC('SELECT '+@sqlDept)
In your case this will be
DECLARE @strDept nvarchar(10)='dept1'
,@strUser nvarchar(30)='user1';
DECLARE @DynamicSql nvarchar(1000);
SET @DynamicSql='select x, y, z from table where '+@strDept+' in ('''+@strUser+''')';
Then
SELECT @DynamicSql;
Will give you:
select x, y, z from table where dept1 in ('user1')
To execute this statement you do this as
EXEC(@DynamicSql);