I have communities on my org. Some members are internal users, and they should see everything. However, now I need to add an external user (a partner) that should not be able to see certain records.
So I need for it to be a member of an existing community, and also not to have access to every account and related records (like Opportunity, Quote, and some custom objects). It should have access to a subset of those records (that are related to specific accounts).
First I thought of adjusting the system's sharing settings to
Private on everything, and then using sharing rules to allow internal community users to see everything, and to allow the partners to see just some records. This way I could use some stupid rule like "Account Name NOT Empty" for internal users, and then specific rules for the partners, like "Partner Account EQUALS true". Is this the proper way of doing this? Can this be achieved with community user licenses?