At least at the high level you will have 2 tables.
HQ & Stores.
One way to handle access at the store level is to have a field on the stores table called "Users with access".
This is a multi-select User field. So as long as you don't have more than 20 'store users' per store. Then you can use this field to indicate which users can view that store (and possibly all the child records).
You will then have your 3 roles; HQ User, Store Management, Store Employee.
Then you can apply the 'viewing' rights to the store users where they are listed in the 'users with access' field.
If you are going to have more than 20 users per store, there are a few other ways to do this, but much more tricky to set up.
