Values to use for $$MIRRORSYNC_USERTOKEN

Hi,

I need to start filtering syncs to prevent some users (not all) from seeing commercially sensitive data. 

Currently all my remote (MirrorSync) users log in to the solution with the same 'sales' account, and all users get all data.

I need to define what to use for  $$MIRRORSYNC_USERTOKEN for filtering.

Would best practice be to create FM accounts in the solution for each user in the system (I have 3 files and 18 remote users so that would be almost 60 passwords to maintain, and growing), then use the get(accountname) as the  $$MIRRORSYNC_USERTOKEN?

Or should I build some kind of 'Accounts' table for them to authenticate against after they login, and use a username field from that table?

Or is there a better way?

Thanks,

ft.