Rather than just letting anyone with a primary email in the system be able to log in to the portal, it would be nice if that was more of a request to login. The user could enter their email to login, but then the system sends an email to an admin at our organization to approve the login and grant access. This would allow us to confirm the profile associated with that email will provide them (and their household/individual/org profiles) the appropriate access.