Giving it by default seems a good idea, e.g. add the permission into the anonymous role?  As long as that means they can't see organisations they're *not* a part of.