Through the user table you can add external customers, where you can use the Company field to associated user accounts with companies.
Once you have all your user accounts in place you can then move onto your portal setup. On your incident form you can use auto-population to set company into fields, or alternatively just don't have them on the form and make them capture on through the system when an incident is submitted. You can use dotwalking to autopopulate fields on the backend similar to how we capture Opened By, for company.
To show only Incidents for that company, you can simply setup the incident page to only show incidents that are for the company of the account logged in.
If you are managing multiple external companies, might be worth also adding an ACL that only allows read/write access to Incidents for a company an account is part off.
