The authentication is by Contact (no other option).
Through configuration of your data tables (adding and populating an Account Lookup) and table permissions you can cover the scenario where Portal Users/Contacts with the same parent Account have access to that Accounts records.
