Best practice for restricting data

[allivant]

New to looker. I’m looking for the best  way to restrict data based on domain/tenants. Obviously someone in Tenant 1 shouldn’t see Tenant 2 data. Currently, we have 1 db and connection. In the model have an access_filter, based on a user attribute I created based on tenants, on an Explore. I thought I could use required_access_grants in a view but that doesn’t filter data right? 

I assume each tenant should have their own model.

Thanks for any help in advance!