Thanks for the reply Colin. I think the first option is the most appropriate, it will still simplify things alot, nice one. The second isn't really useable as two IP's (it's all client web proxies) needs access to multiple domains pointing to a single VS but only specific URI's on those domains, another single IP needs access to only one of those domains and on and on and on. That covers a client, their call centre provider and their IVR system. Then you have another client, different domains, same VS, same URI restrictions and so on. Every client has a slightly different setup and trust levels for their IVR providers etc are also different.
It's efficient on the server/platform side but tough to manage, hence the need to seperate the IP's and data group to keep a grip!
Thanks again.