Your understanding is correct. A EMA user affiliated to an Organization can see all the RPIs "owned" by that organization, and all Regulatory Entitlements assigned to that Organization. This is necessary to allow the person to submit applications that require reference to an existing RPI or an existing Regulatory Entitlement belonging to that organization.
It is not possible to grant selective access to RPIs "owned" by an organization. The only strategy in this case would be to transfer the RPI temporarily to Company B, which then would be the applicant and would receive the outcome of the procedure. Once the application is submitted, the RPI can be transferred back to Company A (or to a third company).
Multiple parallel procedures with same RPI, but from different applicants, should be possible in IRIS.
RPI transfers can be performed by the current "owner" directly in IRIS, and the procedure is completely automated.