SecuritySuite - SuiteCRM and CE Teams

I am trying to setup the system where I would like our external customers (Accounts, Contacts associated via groups or roles) to have "group" level access to their data and the Internal Sales team have access to all the data for all the customers. A few questions: 1. How do I get auto-assignment / inheritance to work in this scenario? 2. I would like to have a common layout for the objects we are exposing to all the groups, do I have to create custom setup for each group? Can this be done at the Role Level? 3. I am thinking of setting up multiple roles (one for each customer company) and assigning individuals to that with group access. One SalesPerson Role for Internal Sales person and an ExternalAccess Group for the company. In this case the idea is when a user logs in, he/she can see only the records they are authorized to. Am I on the right track here? Thanks!