Both of your two variants will work.
**Variant 1:**
This is the easier way. You can create a complete new application and deploy all projects in that application (portal projects / custom projects). You can configure one security system that is valid for all of those projects. Because you can't change a security system of an application, you must create a new application instead of reusing the already deployed portal application - if you don't want to use the Ivy Security System. If you use the already deployed portal application, please remove the preconfigured user or change the passwords.
**Variant 2:**
You can also create multiple applications. One application for the portal projects and one or multiple applications for your custom projects. But you have to ensure that all users are also available in the portal application as in the custom applications.
A common use case could be:
- Application A: Portal Projects
- Application B: Finance Projects
- Application C: Human Resource Projects
If your security system is an Active Directory you can use filters for application B and application C, which filters all Finance employees or human resource employees. For the application A (portal) you must include both (finance and human resource employees).
One **One major issue for this deployment is, that you need for each user two licenses.licenses.**