Use a product user account. Access is determined by roles and site scope.
Access is controlled by roles and site-scoped memberships.