We are designing a contract management system in SharePoint 2013. The contracts are separated by departments and by locations. Users in a particular department/location should only have access to contracts in their own department/location.
We are thinking to create 1 site collection for each department - this ensures that we stay within the 200 GB content database recommendation. In each department site collection, we will have 1 document library with 1 folder for each location - permission inheritance is broken on each folder to restrict access on a location basis. We thought of 1 document library so that we can use out-of-box SharePoint views for reports across locations for executives to see.
The problem with this design is that there are about 250 different locations. This means, in each department site collection, we will have to create 250 folders in our document library and break inheritance on the 250 folders.
Another approach would be to give no one access to the document library & use a custom drop off library form to add documents. We can create a web part which elevates permissions and displays only those documents that users are supposed to see. The advantage with this approach is much less broken permission inheritance. The disadvantage is that we won't be able to use OOTB views and we'll have to implement our own search.