If you are just trying to limit the CIs on the company, category, and Subcategory then I could not put it in dropdown but use the user information to find out what company they are from. Then you only have category and subcategory which would be best practice. This way you could filter the list of CIs base on Category, Subcategory, and Caller.company (as an example for incident). This would be a much easier way to do it. That being said you would need to make sure users always have the company field filled out as well as the CI would need the company field set.
