Modules are not the same thing as Controllers. A module holds all of the parts of your application. That includes Controllers, Services, Directives, etc. A Controller is only one thing that belongs to a Module. A Module not only holds parts of your application, but it also allows each of the pieces to find each other. Modules are the basis of dependency injection.
So you have 3 different firms within a single company. Are those firms apart of the same domain? Are they separate websites or a single website? If each firm has their own domain or separate websites you will have no choice but to separate them into separate angular apps. A single page application cannot span multiple domains.
If you are defining routers per module then you're looking having separate applications. You can define 3 separate modules and import them into a Main application, but the Main application would define the router. I'm not entirely sure you can have multiple routers per app in separate modules. I can't find any examples of that. In theory maybe, but it seems like it would be difficult to maintain.
But only given what we know it's hard to make any more recommendations because how the 3 firms interact isn't really known. Will they share code? Do they have to be all in a single page application or can you split them into separate html pages each with their own angular app?
Updated:
So I would separate each firm into their own App with their own router. I would make them each a separate single page app. You can choose to share code or not. My application consists of multiple single page apps and I share code between them. Here is how I do it:
var RegistrationApp = angular.module("RegistrationApp", ["ngResource",'ui.bootstrap',"ngRoute", "ngAnimate"]);
var App = RegistrationApp;
Then in any other type of thing I define I use the global variable App like so:
App.factory("RegistrationService", function($http) {
By having the global variable App defined in all of my applications that I build I can share code simply by including those components in with the app the client is loading and it'll pull in that code into that App's module.
Login will be something the server side does and it will drop a cookie on your browser so each app technically could use that authentication provided the cooke maps to the domain. If you have separate URLs for each firm (ie firm1.company.com, firm2.company.com, firm3.company.com) you have to be careful how that cookie is defined because by default if you login under say www.company.com that cookie will not be seen by firm1,firm2,firm3 because those are different domains. You'll have to set a cookie for .company.com so subdomains can see it. But if you do it right login won't require communication between firms/Apps.