How Different Can Presentation Layers Be?

Let's say you have a three-layer architecture just to keep things fairly simple (presentation, business, and data layers). The business layer has the more useful functionality that needs to get called, and the presentation layer is essentially a gateway to access it. It would seem pretty reasonable that if you have a website for your application and you wanted to also provide a mobile application with the same functionality, those could simply be two different presentation layers that utilize the same business layer.

My question is about when you start to move beyond slapping a different front-end on the same underlying functionality. For example, let's say our application is an ERP system where you can create customers, enter orders for customers, invoice those orders, and view order history. If we now need an additional customer self-service portal application, how would this fit in with the three-layer architecture? It would need very similar functionality and would share the same data, but with critical differences (ex. customer needs the ability to submit an order with all of the standard business rules and validation, but obviously cannot create orders for any customer and can only create orders for themselves; additionally, any information regarding costs/profitability that internal staff needs should not be available to customers in the new self-service portal application).

Given this scenario, it seems like it would be feasible to treat the new self-service portal as a different presentation layer that calls into the same business layer, but I'm not sure that sounds like the right thing to do. It seems like this could be fairly dangerous as it could be pretty easy to accidentally leak out data that should only be accessible by internal staff. A new business and presentation layer could address those concerns, but then you'd have to do something about the duplicated rules/logic (ex. either copy/paste which is obviously bad, or split out the common things so each business layer can reference the same rules). Or would this be something "different" enough that warrants having all three of its own dedicated layers (which also doesn't seem right, as any new common features would have to be implemented in both systems)?