I like your 3rd alternative idea since aud.
filtering is not really secure as you mentioned.
If I used the 1 site  for 400 user locations, i was thinking i could just
create a folder for each 'location' in the lists and then i would not
reach the 2000 item ceiling, but i think if you have access to only the
folder level, you still have to click in the 1 folder you see when your page
loads. Do you know if there is a way to not make the user click into the
folder to see the items, or will it always load the list with the folder
there?
I wanted to use CQWP so i could pull  items from a central  source, but i
guess i wouldn't need this if there was only 1 site for all 400 locations?