One of the most common configurations out there is related to allowing web2project users to have access to only specific companies. While it's not as simple as saying "users should only see things from their own company," it's not as complicated as you might think. Here's how I've done it for various groups.

If you start with the basic roles, here are the step by step directions:

Role: Project Worker

Non-Admin Modules - Allow - Access, Add, Delete, Edit, View

Companies - Deny - Access, Add, Delete, Edit, View

Reports - Allow - Access, Add, Delete, Edit, View

Explanation: This gives access for a User to do anything they want on any of the non-admin modules *except* for Company. But since all of my Projects are assigned to a company, they can't actually see anything other than the navigation menu and empty screens.