i need to create a setup that will require a global group login and also an individual login for each group member.   

after initial group login, i want a list of existing employees to appear, where click and password gets them in.

each group will have same functionality, but different data.   all applications will be shared, but nobody should be able to see anybody else's data.

so i've thought of using a dual login system, then filtering data in each application by group-user combination (cookie probably).

alternative is each group gets their own website (i hear DNN can make n websites all running from the same installation?)

third approach is using some sort of group joining function, where each group has an admin that can approve members, then filter application data by group membership.

i figure any of these might work, but wonder if anybody has the bruises to know which will work better, and maybe there's even a commercial module available?    this is a medical facility, and patient confidentiality is paramount, so nobody can find out data they aren't priveledged to know.

some users will not have separable email address, and may have same "real" names (don't want fictitious user names).  group login will be most secure, with individual login mostly for convenience.

i'm new to DNN and hope somebody can point me in a good direction to start, i would greatly appreciate the help.