I've played around with this as well, and one important thing is: Do not give a user access to a document unless they are member of that site, or the site is public. If you do, the document will be returned in a search, but when they click on the document, Share fails to render the client GUI correctlym since they user are unauthorized to that site.
Disclaimer: I've not put any such "workarounds" in production, just checking if and how it could work to add the capability to assign user rights to individuals. I will say it needs more testing.