Depending on the level of data separation needed, multi-tenancy can be achieved with a good attribute-based access control authorization setup at the GraphQL server level. Prebuilt solutions are available with a service like Auth0, or you can roll your own with a library like https://www.npmjs.com/package/passport.
The server lib (like Apollo Server!) can check the user’s tenancy at the time of request with middleware, then route to where ever it needs to go
On the database side, you can separate data by database, table, or just rely on the server level auth, depending on your separation requirements.