Trying to set up our site in the simplest way to allow external users (vendors/customers) access to specific groups or content.
We are in a manufacturing environment and one of the biggest impetuses for us using Drupal Commons and OG groups is collaborate with external customers and vendors.
Our internal users now have pretty much free reign to join any group and see any content. This allows anyone to jump in on a project where they see their input is needed.

The problem obviously comes with adding external users. Ideally I would like to define an external user and give them access to only a specific group or node in that group (wiki page, etc). They would not be able to see anything they were not granted access to.

Is such access possible without locking down the entire site making all groups private?
Is it possible to allow access to only a single node or piece of content?
Are there best practices out there already?