The best way to setup access for different clients

[UdacityShone]

I am setting up jira to be used as a ticketing system. I have more than 2 clients. Every client should be associated by 1+ projects. Clients should access only their own projects. Should not have access or visibility of other client projects. Also need to create internal groups as one group is working on one client, another group on other client projects. Sometimes, some group member working on more than one project.

What will be the best attitude ?

Should I create 2 permission schemes (internal and external), associate them to different created project roles ? I presume that i need to create one project role per client ?  But one role will be associated to all projects of the same client. Clients will only have possibility to open ticket and update comments. 

[Deleted user]

Why don't you just utilize the "roles" of the Project and user "groups"? Imagine you have one shared permission scheme, for Project A, you have role "Users" which has the "browse permission", put the group "Client A". Only Client A will have access to Project A. Do this with other projects as well.

You can also use Issue Security Scheme if you feel this is not enough. https://confluence.atlassian.com/jira/configuring-issue-level-security-185729623.html