Thanks for the tip. The question is broad because I am looking for guidance how to even get started tackling the problem.

The application will allow buyers to complex RFPs online & sellers to respond to them - a collaboration. I will need access control to allow users within and across companies to collaborate with appropriate restrictions.