Yes, it would be possible to limit the extract authorizations by any organization element - like company code, or sales org, etc. Connector comes with 2 standard roles which can be copied and changed to your restrictions and then assigned to the extract user your subsidiary company will use to connect to SAP and extract the data.
Most of the "Parent" companies are worried about amount of the data extracted and the time of the extracts, as it may put some load to their SAP systems. There are best practices based on the experiences available, but nothing in form of an article or a white paper.
we do it in two ways:
1. we save our SAP reports in different formats (*.xls, -*.htm) on theserver and so we are able to load them into the scripts.
2. with SAP connector and then only our "Buchungskreis" or "Kostenkreis";
f.e. : EKBE:
load *; SQL Select * from EKBE where KOKRS = $(BUCHUNGSKREIS) ;
Store EKBE into EKBE.QVD;