L7 Applicator

I would go with @TomYoung suggestion.

just one portal with one gateway, then the gateway can have many configs that can differentiate between users vi user-id and distribute ip as required.

 

or just have the same gateway for all and base your policies on user-id only.....