I had the same question. After much poking around I found that under Admin / Application / Tracking System / Site configuration, under the queues I creates / configuration I set the “set Restrict tracker items to staff and:Group” restrict to Creator.
I created a user group called client-tracker that only had access to the Tracking System.
Finally, I created a user account for each of my clients in the client-tracker group who can access the tracking system.
I logged in as the clients and tried to break out of my permissions jail and couldn’t. This might approximate the support site that EPL clients have access to.
Standard disclaimers apply.
Not sure how the guys at egroupware created theirs, but this worked for me.