Hi.
Depend on your choice of management.
If you will be using Mobility Conductor/Mobility Controllers to manage APs, then you can achieve full data separation with Multi Zone configuration eg. using separate MC for each tenant (limited to 4 tenants).
With MM/MC configuration you can also group APs and broadcast SSIDs for specific tenant only on APs in tenant's AP group(s).
If you go with Aruba Central, with or without Mobility Gateways, you can also broadcast only on APs for specific tenant. With Aruba Central you can also use Azure AD integration for user authentication.
There are many options available. Check Verified Design Guides for much more info.
Best, Gorazd
------------------------------
Gorazd Kikelj
MVP Expert 2023
------------------------------