Validate user permission with Firestore security rules for multi tenant app

I have been working creating a multi tenant app in Firebase and Firestore. The current structure is somehow like this:

/users
/companies
/company_user (this links the company and the user, with userId and companyId)
/service1
/service2

Basically, each company might have some service enabled or not and users are assigned to companies. User can be linked to multiple companies.

I am creating some security firestore rules and I would like to be able to restrict read/write operations into each service documents depending if the user has a company linked or not.

Most basic rules are working however I would like to verify that each user has access to the company, and that the company has access to that service.

Basically this would mean checking in companies_user to see if the user has the company linked, then if the company has that service (each service document has a companyId field to verify)

I cannot see how this can be done using get() or exists().

Can this be done? Or should I restructure my data? Something like:

/companies/{company}
/companies/{company}/users
/companies/{company}/service1
/companies/{company}/service2

I am not a fan of this because this would mean having data all over the place, but maybe I am too used to SQL and NoSQL not so much.

Thanks