I would start by adding company_id field to roles and permissions tables, then adding company scope to roles and permissions relationships:
https://github.com/spatie/laravel-permission/blob/master/src/Traits/HasRoles.php#L40 https://github.com/spatie/laravel-permission/blob/master/src/Traits/HasPermissions.php#L41