if the permissions used by all tenants are basically the same, option 1 is the way to go