[otrs] Customer Access Restrictions

Consider a company that uses otrs for it's helpdesk application for internal purposes. It's employees create trouble tickets. What would be a correct approach for this? Do I create a single customer and employees as customer users? If so, how do I prevent customer users from updating the other tickets? or Do I create a separate customer for each user? Thanks in advance