Installing / updating modules in multi-site environment
You have described the options for multisite pretty well:


Lots of shared code by putting modules in /modules 
Lots of copies of module code by moving to /sites/[sitename]/modules but only one copy of core to update. 
Use multiple instances instead of multisite (lots of copies of the same code but the ability to update one without risk to others).


Multisite is most useful when there is low variation in the configuration between the sites and therefore you can safely use the same copies of core and the modules on most (if not all) sites.  The more variation you have between copies the more likely it makes sense to ditch multisite and move to multiple instances.  

While there are some very large instances of multisite in use, there are also people in the community who feel pretty strongly that multisite brings more headaches than it is worth.