How to limit B2C app access?

Question

When creating the B2C app registration in Azure you have 3 options:

"Who can use this application or access this API?

Accounts in this org directory only (My company AAD)
Accounts in any org directory (Any Azure AD Directory - Multitenant)
Accounts in any org directory or any identity provider. For authenticating users with Azure AD B2C."

I have the following B2C questions.....

1. For B2C app, how do you limit B2C app access to my company AAD plus one other external / customer AAD?
2. How do you restrict which users within a given AAD have access to this app?
3. How does this contrast with limiting user app access in Azure Enterprise App?

Answer 1

1. You can leverage Azure B2C Custom policies and add 2 Azure AD identity providers.
2. Trough Restrict your Azure AD app to a set of users in each of the Azure AD apps used by B2C for federation hosted in each of the Azure AD identity provider tenants.
3. Azure AD Enterprise Apps is involved with #2.

Answer 2

Does #2 imply that each of your application tenants require a separate Azure AD tenant with a subscription to manage users/roles?