Hi @arnaudp,
Based on the Authorization Flow guide (Which OAuth 2.0 Flow Should I Use?) it sounds like Client Credentials flow is right for your situation since the client is the resource owner.
With Client Credentials flow, you can add tenant-specific data to tokens in custom claims by using a Client Credentials Exchange hook: