Thanos supports multi-tenancy by using external labels. For such use cases, the Thanos Sidecar based approach with layered Thanos Queriers is recommended.
You can also use the Thanos Receiver however, we don't recommend it to achieve a global view of data of a single-tenant. Also note that, multi-tenancy may also be achievable if ingestion is not user-controlled, as then enforcing of labels, for example using the prom-label-proxy (please thoroughly understand the mechanism if intending to employ this mechanism, as the wrong configuration could leak data).