A solution you could use would be to use resposibility centers instead of security roles, with responsibility centers, you can assign the user to a center and the customer and contact also, this way they only see there customers and contract. The responsibility center also filters the lookup list, so...