Customers follow the same route, from their side

The customer portal is membership plus a verified email, not a global role flag. People see the tickets they filed in that workspace.

Anonymous filing still works. An intake-created account can be claimed later. A passworded or already-verified account cannot be taken over by a claim.

My tickets across organizations lists every request the signed-in person filed, then sends them back into that workspace to reply or reopen.

A partner can vouch that they authenticated an email. Vouching does not open the portal by itself. A short-lived handoff does, and only for the accounts that qualify.