if a contract is not assigned to a portfolio they can see those support tickets as well.
Seems you need a "lock expression for the contracts table as well.
they can also see other records as 'no access'
Any find performed will automatically exclude 'no access' records even if they match the specified search criteria.
You can use a script such as this:
Enter find mode  // clear the pause check box
Set field [YourTable::AnyFieldThat'sNeverEmpty ; "*" ]
Perform Find 
This will find all records for which viewing access is permitted.
If you have FileMaker advanced you can use custom menus to either disable Show All Records and Show Omitted Only or to replace the built in action with scripts that omit the access denied records.
After some more reading I realized that the privilage set restricted access and not the view. I'm working on implementing the find as suggested above.