Multi-company organizations, do you create BR's per company code?

For those of you who run an instance of S4C containing multiple companies, have you set up Business Roles per company? In other words, is your user access/permissions set per company?

I'm told that it can be done, but we have been advised against it because it is cumbersome to set up and it creates an administrative nightmare.

So again, if you are a multi-company organization, have you set up your access and permissions per company or perhaps per groups of companies? Or do your Business Roles simply grant access to apps without regard to company code?

Thank you.

Ralph