Firstly thanks for everyone's input on this.
I would like to take a step back here and imagine the feature I would really like (in an ideal world) in case any of the product managers are listening 
(hint: Aviad Rivlin )
So at a high level if would be:
The ability for portal roles (and other PCD content) to be filtered based on the access channel.
So based on how the user has got to the portal (internally or externally) the portal would allow me to tag a PCD role as available or not. This is very similar to the Filter ID currently available but needs to add a security aspect not just filtering.
Then I could have 2 roles both assigned to the user (1 Internal ESS role and 1 external ESS role) and depending on how the user got in they would only get one or the other.
For now I am probably going to recommend two portals, in this case we probably don't have the appetite for a custom login module..
Cheers,
Simon