I've asked a similar question in the past, but VSTS has changed quite a bit over the past year, so maybe we can do this now.
I would like to have a single project for our company. We have employees who work on multiple teams on multiple projects, so specifying capacity on each project just doesn't make sense. These employees can see everything if they want to, doesn't matter.
We also have external people who need to login. They should not be able to see everything. They shouldn't even know that the other teams exist, just the ones they have been assigned to. They shouldn't be able to see dashboards, they shouldn't be able to see the teams when they browse. I understand I can restrict like this at the work item level, but that is not enough. For all intents and purposes this is a separate project.
I can make the security work with only minor pain if I do separate projects, but then I lose the capacity planning. My questions are
1) Do I still have to do separate projects for this level of security?
2) If I do what would you recommend for easier capacity planning? Seems like Power BI can't access this data.