One front door. Nobody gets in by accident.
A Portal is where your team reaches what you have built. People sign in with a one-time email code, through your own site with signed sign-in, or from HighLevel. Signing in never grants anything on its own: only the groups you admit get through.
Sign-in is always required. There is no anonymous access to switch on by mistake.
Admit whole groups. Anyone else is turned away before a code is ever sent.
Signed sign-in lets your intranet vouch for employees so they skip the code.