I am not saying it is the best way, but I would do this: I would have the public site and members functionality (members admin) on the main install of CI. I would put the master admin parts in a separate install but connected to the same database, in a sub folder called 'admin' or 'manager' or similar. Then all user functionality is contained in one install, but administration activities are coded in another install.
I know a lot of people will say that this can easily be achieved in a single install, and I agree that it can. But I like the separation.
This also means the members functionality can be easily and tightly integrated with the site, so say a member is logged in, the header on the homepage can change etc. It also means you can completely close off site admin parts without affecting the usage of the actual site, or switch off user access but leave the main admin parts functioning.
Finally, it also means I can re-use the admin sections easily between projects, without any affect on the main sites at all.
However, in general, the best solution for you will be heavily dependent on the type of site and the types of admin functions and the project goals as a whole. I doubt there is just one correct or best answer in any situation.
