The step by step answer for your question will be very long. But I will try to brief it.

As you want to create multi-tenancy, at the beginning its important to create domains. Create number of domains you wish to. After that its common practice to assign admin to each domain. You can also assign normal users to each domain. So its time to create users. During the creation of user, fill the field Tenant ID with the domain-name you wish to restrict the access. Don't forget to fill Groups for this user field as it completely speaks about Role/Permission he/she has on that domain. If you assign Administrator , then the new user can see all domain. Its better to give PowerUser Role as he can access only one domain that he/she has access to. With the proper hands on with Nuxeo default groups, Tenants and User creation, one can easily achieve multi-tenancy in nuxeo. Hope this info works for you. Please revert for any clarifications.