What's the best way to filter out data a user isn't allowed to see?

Question

I have a user, that user is 1:1 with a company. I have many users, who have many companies.

These users have data they interact with - entities like documents and boo