Yes that’s the general setup. You should link the company on the user table (either in addition to the users being nested under the company or instead of). Then you can set up privacy rules that user’s can only see their company’s things.