Managing my user permissions for my Publishing site / enterprise wiki

I have created 5 separate enterprise wiki sites, which can be accessed using the following URLs:-

1. …Wiki/HrManuals

2. ..Wiki/SalesManuals

3. ..Wiki/TechnicalManuals

4. ..Wiki/legalManuals

Now I need to implement the following:-

Requirment1. Each site collection will have different permission level. For example if an employee do not have any relation to the sales department then he should not be able to edit, add or delete any of its manuals, but of course since he is an authenticated user within our company he can view the wikis or download any attachments.

Requirment2. Certain departments, such as legal department have asked to restrict publishing any wiki inside its site collection, only until it is approved by certain users. So that if a staff in the legal department write a wiki then its status will be for example “draft”, then authorized users can review it and publish it or modify it.

My questions are:-

1. Which user permissions I should use to implement Req1. I am think of defining a “Contribute” permission to all the employees under the department, while define “Restricted Read” to employees outside the departments. So is this the right permissions to use?

2. Which user permission I should use to implement Req2. And I cannot manage how I can implement the following business rule “any wiki created under the legal Site collection cannot be published unless it is approved by either UserA or userB”.

3. Is creating separate enterprise separate wiki site collections (currently we have 5) to manage the wikis for each departments, the right choice to implement?.

4. In case we want to engage our customers to be able to view certain wikis. So what is the best approach to follow so that I can restrict that each customer can read certain wikis?

Thanks in advance for any help & Sorry for the long email.

Best Regards