Yup - that (in general) the recommended pattern. Resources in one Project are isolated. If you need some kind of "partnerships" pattern (common in referral workflows) you may consider using Access policies https://www.medplum.com/docs/auth/access-control#healthcare-partnerships