Best practices on restriction operators access to recipients

Hi all,

Can you please share how you're managing access rights for your operators? In our case we have millions of recipients divided by groups and groups of operators who should be able to target one or many groups of recipients.

I see only 2 ways to deal with it:

1. Give every operator and recipient some property, like groupId, and then add sysFilter to nms:recipient so every time operator will Query recipients, he should access only those which groupId matched with his groupId.

2. Store recipients in separate folders by groups and grant read access to such folders to operators groups.

Is there any other options? And does anyone have an idea which way will fork faster (in terms of Query execution time) with millions of recipients?

Many thanks,

Andrey