Best practice for docroot location with separate corporate website, and multiple stores?

[ddbear]

I installed Magento CE 2.1 in var/www/html/magento and then set the apache VirtualHost DocumentRoot to the same.  But I was also thinking of putting the main corporate website in var/www/html/companyname, and DocumentRoot pointing at this, rather than DocumentRoot going straight to Magento.  There will be a main corporate site and the Magento store is a subsection of the main website.

Ideally I was planning to organize the directories this way:

var/www/html/magento (shared installation with two different Magento websites and stores)

var/www/html/company1 (corporate front end)

var/www/html/company2 (corporate front end)

If I point the DocumentRoot to company1, then maybe I'd have to place magento inside the company1 folder?  But then this would not look good for the company2 URL which would also share the same Magento installation.

I'm probably not aware of some Linux features (URL redirects etc.) that would make it easy to organize this and keep the URLs cosmetically nice.

Also, what would be the best way to change the relative link that I configured during Magento installation (when I removed "/magento" after the domain name)?

[ddbear]

I think I solved part of my own question:

The shared Magento installation is in /var/www/html/magento

Company1 is in /var/www/html/company1

Company2 is in /var/www/html/company2

In each Company docroot, I created a symbolic link:

shop -> /var/www/html/magento

I created separate Websites, Stores, and Views for each Company in the Magento Admin.

But how do I create user roles that can only see their own Company data?  In the user role settings I see ways to adjust Role Resource Access for all the fine grain admin features, but how about Role Access for particular Websites/Stores?