You don't need anything from Azure to do that. Authentication policy and silos are what enforces multi tenancy east west boundaries (among many, many other layers outside of the scope of this conversation).

But it looks like I misread what the "client" context was initially. So that's my bad. That does muddy the waters and would depend on what the agreements are between the companies and OP have. But this isn't a technical constraint rather a business and legal decision.