When there are multiple companies associated with one another, users should have custom permissions for each. (ie if you give a user access to financials in one company, it should not carry across to the other companies unless specified).