@Ambient.Impact for your described solution in #4 there is custom code involved as well? (via the Symphony events?)
Or have you been able to do it, just using modules and admin?I found multiple ways to grant permission / access to a node on a role basis, but none on a per user basis.
ACL seems to be the module to use - but there seems to be no connection between Commerce 2 and ACL possible, without code.