Restricting Access and Visibility

CLM 603-605

We have a project team that tracks their internal work in one RTC project. They also have a different project that they work with an external department for "requests". At times they pull requests over into their own project, which loses visibility from the customer.

Our IT dept wants us to use a similar setup for our internal work and external department requests. Isn't there an easier way to do this with "Restrict Category Visibility", "Restrict Work Item Access" and Roles? If I create a work item type called Support Request and a Team called External:

1 - With "Roles", users can see everything, but only I can limit Save Work Item to Support Requests for the Team External.
2 - With "Restrict Category Visibility" I can make sure only "Application Support" is shown in Filed Against...right?
3 - With "Restrict Work Item Access" ... does this mean they will not see any work item that is not a Support Request?
4 - Since they are in the team External, they can go to that Team Dashboard, but what can they see on the main Project Dashboard?
5 - Do JRS and regular queries follow the access control, or can users see all of the work items?

Looks like it will work, but I don't know what I don't know.

Thanks for any guidance..