I would recommend you the following setup:

1. To secure each company's processes, a distinct system user for each.
2. A single shared Postgres database server, with a distinct database role for each company. This way each company won't be able to see others databases. 3, A dedicated OpenERP copy for each company, accessible only by the corresponding system user. Each will run it's own server process on a distinct port (ex: 8070, 8071, 8072, etc.)
3. An upfront webserver, such as Nginx or Apache, acting as a reverse proxy, in order to: provide SSL, map domain names like mycompany.myserver.tld into localhost:port, and could also provide a static data cache and load balancing.

Having distinct Postgres roles for each companies solves the dbfilter issue: each role doesn't even know the the other companies exist. And if you choose for a company to have only the Production database, the database dropdown won't even show, making it simpler for the end user.

At #3, you might think it's a little too much to keep an OpenERP per company, and that it can bring unnecessary extra work every time you want to apply product updates. But:

• from a security perspective, it's easy to see that it's preferable for each company to have access to it's dedicated copy.
• From a product maintenance perspective, it also ends up as a better choice: yes it will bring some extra work to update all instances, but you have a choice to do it gradually (and start with less complex companies), or to selectively apply fixes only in the instances that really need it.

By now running three independent server processes is unavoidable, since each one needs to run under a different system user and database role. And that's a good thing: if for some reason one company's process is killed, there's a good chance the others will be unaffected.