On-Premises Connection Sharing Best Practices

I am looking for best practices to organize and share connections to on premises data sources.  

To refresh a Power BI model from an on premises source, a gateway connection needs to be assigned to the model, and the configuring user needs access to the connection to assign it.  How do folks handle the requirement that different semantic models require different subsets of data from the same source database?

A few options come to my mind. I would appreciate any feedback on these or other options.

1. One connection and one service account. The service account has broad access to the source data. Access to the connection is restricted to central PBI administrators, who must configure all reports for on premises refresh.

2. Multiple connections and multiple service accounts. Each connection authenticates using an account with access to a subset of data (e.g., marketing connection sees marketing data, HR connection sees HR data, etc). Developers are granted access to connections based on group membership (e.g., marketing developers can use marketing connection, HR developers can use HR connection) and can configure their own reports for refresh.

3. Grant developers access to create (but not share) connections on the gateway. Developers create connections using their own credentials and use these connections to refresh Power BI semantic models. This limits the connection to data that the developer can already see, but may result in a proliferation of connections on the gateway. Also, refreshes will fail once the developer leaves the organization.