I'm an avid BaseCamp user and BaseCamp gets this just right. E.g. I want to invite a client to a project (let's assume it's a List in Upbase). I do NOT however want to give them full access to everything as we create internal tasks and "Sections" etc. where we discuss things amongst ourselves, assign tasks for dev, UX, UI etc. that the client does not have to see and in fact should not see. We individually grant the client access on each item.
They can be default see the docs & files, can start a discussion but can't see all discussions, only those they have started, or we have given them access to.
And in BaseCamp, we can clearly see what the client has access to as it has a prominent colourful badge letting us know the "Client Can See This".
I hope the above is clear, if not I'm happy to elaborate?