Ideal solution for PowerBI setup

We are in the process of setting up a SaaS analytics service built on PowerBI. To give a brief background, I am providing an illustration of how the service needs to be deployed and data sharing requirements. 

a) Service is deployed to all subsidiaries for a company. Each subsidiary is a SaaS customer. 

b) Data generally is not shared between subsidiaries but in some scenarios some data have to be shared when employees move between companies. 

c) Aggregated data is also shared with the parent company. But they don't have access to the detailed level data.

Given each of the company has its own LDAP/AD setup, initial authentication is done at webapp layer with Azure B2C authentication. Once authenticated, they are directed to powerBI reports/dashboards with PowerBI embedded. Webapp to PBI has service to service authenticated. Basically all access is over a standard database connection and access control for different functions is enforced in the PBI report design. 

Key question is what is the ideal deployment combination of dataset/workspace/pbix that enforces security, and is easy to manage & support PBI environment including dataset refresh, CI/CD, backup etc. 

Should we have one single dataset for all subsidiaries (data size is not very big) or go with different workspace/pbix option? 

I am not a PBI expert and hence please let me know if you need any additional information or if my understanding is wrong, please correct me.