Access to queus in which customer can't create tickets

[automo]

Customers in my system can create tickets only in 1st support level queue (the only queue with "users" group in queue definition). I have problem that when agent moves this ticket to another queues customer can't follow ticket solution progress anymore.
If customer tries to access these tickets via direct link, he gets error: Insufficient Rights No Permission!
What would be the best way to let customers create tickets in 1 queue but let them follow ticket resolution and reply to agents in some more queues?

[crythias]

allow the customers to be members of all groups (turn customer group support off?), but restrict visible queues on submit with ACL.

[automo]

But in that case isn't it the same scenario as defining "users" group for all queues?
I have defined agents<->roles<->groups relationship and in this case all queues will be visible to all agents because they all are users, as well.
Am I right? Can I limit this?

[crythias]

all queues will be visible to all agents because they all are users, as well.

Agents will be restricted to what the agents can see. Customers will be restricted to what Customers can see.
that an Agent can log into both sides only affects what the Agent sees on the side she logs in. (That is to say, Agent will only see what she can see as a Customer on customer.pl, but that's different from her rights in index.pl)