If we are hosting multiple web sites on a single machine,on behalf of multiple customers, we'd need to have the ability to have completely separate user and role sets for each site. Of course it would be nice if all of this were done with a single install of the product and its database.

Would that be possible?

You can secure as many dotnet applications as you want in Visual Guard .Net. You can secure them each in one different repository, with separate list of users and separate list of roles.
This is done with only one install of Visual Guard .Net and its database.