Isolated subset of users

Participate in the development of the portal, whose clients are whole company, with its own users, admins, groups permissiyami. All clients work with the same models, but should be completely isolated from each other.

What approach advise, Habr? Maybe there is something ready? What are some best practices? Particularly interested in a flexible model takes into account the isolation permissy objects of one of the objects of the company to another company.