Forum Discussion
Advice for creating and migrating to a SharePoint Intranet
HiObiquitechAdmin ,
Regarding 2)
See my answer (that you already liked) here .
I would create a team site with a Microsoft team for each department. That site is meant for internal collaboration inside of the department, so all members can access and edit all files.
Then I would create a communication site, invite the "Everyone" group inside the SharePoint "Visitors" group and invite the M365 group of the team site into the SharePoint "Members" group. That communication site can than be used to share information with the rest of the company. You also can put some "Who we are/What we do/Our News" pages in that site and link them in your intranet navigation.
Regarding 3)
You as a user can share files directly. If you press the three dots next to a file and then select "Share"
then you can share that single file with people in your organization
You can change the sharing mode, if you press the little gear at the top
People in <Your tenant> means that that everyone in your tenant will have access to that file using the sharing link you create
People with existing access means that you create a link and only the people that already had access will be able to access that file using the link
People you choose let's you choose the people you want to give access to. You can also share that file with external people, If external sharing is enabled for your site. They have to authenticate using an M365 Account from their organization or by creating a microsoft account.
Anyone Creates a sharing link that does not require an external user to sign in. This is normally disabled on communication sites, but you can enable that.
External Sharing can be enabled and disabled by a SharePoint admin on individual site collections in the SharePoint admin center.
So you just need to enable external sharing on the site that your document is on (if it is not already activated) and share that file with an external contractor using their email and the "People you choose" Option.
Best Regards,
Sven
Thank you SvenSieverding for your detailed reply.
Re: the point about the intranet and department set up, that definitely helps clarify some structure for me, thanks. I did see that answer and I did get a lot of value out of it but I think I needed this simpler version to understand it. 
Re: the last point with sharing. I was actually aware of those sharing capabilities and that you can set the organisation level sharing settings as well, like in this image:
I apologise for not clarifying in my post. What I am trying to achieve is for a single folder containing restricted files in the OneDrive of one of our Global Admin's (in this case, the client business owner(s)) to not be accessible by any other Global Admin. (See the "Get access to files" option in the right window in the following image.)
I have read https://answers.microsoft.com/en-us/msoffice/forum/all/onedrive-limit-the-admin-access/e4134d9d-dfd8-4389-82dc-d2089d94aed9 relating to this exact question, but obviously that doesn't solve my issue.
So, obviously it's not an inherent Microsoft Office365/OneDrive feature, but I'm trying to figure out how the best way to go about this would be without this feature? I.e: A client (the business owner who we are their IT/admin for) requires a place to put their non-sensitive documents in (this will be put in a collaborative Document Library on SharePoint), and a place to put restricted files in that only the two owners of the business should have access to.
I'm not opposed to out-of-the-box solutions, or accepting that they might need to use personal OneDrive's etc, but hence my question here to see if this is possible keeping it all in the business account. So far I've found that if they https://support.microsoft.com/en-us/office/protect-a-document-with-a-password-05084cc3-300d-4c1a-8416-38d3e37d6826?ui=en-us&rs=en-us&ad=us#ID0EAACAAA=Windows&ID0EBBF=Windows then it's inaccessible by anyone without the password, but I feel this might be a slapstick solution rather than a permanent and "best practice" solution. Especially considering the issue of "what if I have 1000 restricted documents to upload?" I don't know if it's possible to batch-protect documents but this seems like a headache, with the sub-issue of not being able to use Power Automate to auto-protect them because then the password would be exposed in one of the steps. It also doesn't protect the file from seeing the metadata afaik, and filename.
If you have any ideas please feel free to share them, otherwise I have a feeling I might have to resort to telling them they have to use their personal OneDrives for protected documents, which means when I port them to a SharePoint library I'll need to set user-specific permissions on that specific library for the owners to view, add, and edit files and no one else.
Thanks for your time taken.
Lunar