Malte,
I think we discussed in AIM creating an employee group and granting that permissions (membership) in all the customer communities.
This might not work with all the user portlets, but for your application you probably don't want an employee to see aggregated items from all the customer communities anyway.
Did you try this? did it work?