I'm trying to envision how a company might set up their matrix infrastructure that works with how SR5 describes it.

For example, in an SR4A run, I might have a small company that had a public matrix presence as one nexus, and another, hidden nexus that served as the worker's are for doing...well, work.

Likewise, when designing an office building with multiple tenants, the building might have a public nexus for tenants and visitors of the building, and a separate nexus for security, with all devices (maglocks, cameras, etc.) slaved tot eh nexus.

How does that translate into hosts? The company would just have one host, but how would they partition off the public and private files/areas? I can't imagine they'd have two separate hosts. Can you have a host inside a host?

What can serve as a "door" within the host?

One host. Encrypted files (this includes objects like maglocks and cameras) can't be accessed except by authorized personnel or matrix attack action. Objects can also run silent so the public won't normally see them. Super secret files can run on a separate device hidden and slaved to the host so that it has to be cracked separately or tracked down manually and accessed directly.