RE: SETTING LOCATION SECURITY FILTER
It seems to me that your client has a business process problem, not a setup problem.
I would encourage them to review how they use locations first before they implement logic to block users from using certain locations.
Regardless, you can use responsibility centres with their default location. One RC can be Purchasing and the other can be Sales.
The RC will be copied to the purchase and sales header so you can use permission filters based on that.
Alternatively, you can enable basic warehousing in those locations and use warehouse employees to allow certain users to use certain locations.