Password protection for section of a drupal website
Introducing password protection to parts of a Drupal website means that you enter the the wild (and somewhat mysterious) world of node access control.

Out of the box, Drupal 7 (and previous versions) only provides a single global permission to grant a role the right to view a node (i.e. view published content in Drupal 7).  To get more fine grained access control to published content, you must use a node access module.  There are several node access modules to choose from.  This page gives a good introduction to the rules that govern node access, and lists the major modules that help you manage node access, along with capsule reviews of each.

There are no single "best" module.  Each module have different characteristics.  I suggest you identify those you think are the best fit for your site, and check them out, before committing to one of them.

Your plan (to have a company user with a company password) have some logistical problems (see last paragraph), but can be implemented (sort-off) by means of a role based access module.  

A better approach (IMHO) would be to create a set of node access "groups" (this can be roles, OG groups, or ACLs - depending upon the module you choose to use), where each "group" consists of all the users associated with a single company. I.e. you assign existing users to these groups. Now users can authenticate with their primary password, but you can set up node access grants to be determined by each user's "group" membership.

The approach you suggest (with a company user and company based password) will have the problem that the company user's password can not be protected against changes without a custom module.  Also, you may run into problems if a user leaves one company and joins another.  Then the old company's passwords must be changed so that this user may no longer have access, and the new password must be communicated to all existing employees of that company.  If you do this the way I suggest, you just remove this user from the group belonging to the old company, and adds him to the group belonging to the new,. That is all that is needed to make sure that he loses access to the content belonging to his "old" company, and gains access to the content belonging to the "new" company.