I would suggest you to use the same standard functionality - use function profile as a base to create a new one - to restrict access for companies. 

Actually you can do it in a single process. The trick is to use the merge button in the Functional authorization but starting from the existing functional profile. You just need to follow these steps:

1. Open GESAFT function
2. Duplicate the relevant user function profile ADMCA for instance into NEW
   
   
3. Open GESAFP fucntion
4. From the existing functional authorization ADMCA use the Merging button to push all functions related to ADMCA into the NEW profile. 
   
   
   Wait for the function update to be completed
5. From the NEW functional authorization use the addition button
   
   
6. From the new screen entered the site or group of sites (FR10 in my example) you want to restrict the access on. Be sure you ticked force and replace as in the screenshot below:
   Then use the Recall button and save button. 
   
   
7. Once all functions have been added, you can save.
   Wait for the operation to be completed.
8. Now all functions that can be restricted per site are limited to the group of sites you selected previously:
   
   
9. Run AVALAFC (just in case)

Et voilà !

Thank you Julien!  That is a much more efficient method, and it worked perfectly.  

It's a neat trick but unfortunatly quite unknown.