Should I add a new Role and have a cap (say) ‘employee”? Or remove caps from the Contributor role?

Both are completely valid approaches but perhaps creating an ’employee’ role with custom capabilities would make more sense?

Regarding the use of a membership plugin, you could go down that route, else the current_user_can() and…[Read more]

You’re right to keep this sort of thing in mind when it comes to securing your site. Take a look at some of these plugins which provide two-step authentication:

http://codex.wordpress.org/Two_Step_Authentication#Plugins_for_Two-Step_Authentication