Authentication or authorization? If it's the latter, I'd model it on what AD/LDAP do: folders/OUs for hierarchy, groups for crossing hierarchy boundaries, then users and securables as objects in the directory. Then on top of that, be able to assign permissions such that node (OU/group/user) -> can-do-action -> other node. Then child nodes inherit permissions as well. We're using something similar in a system I worked on and sys admins and end users are pretty comfortable with it since it used the same paradigms they're used to. You can also use the same thing for multi-tenancy by just creating OUs for tenants.
For authentication, whatever supports ADFS, SAML and/or OIDC. It's a big plus when they can use existing credentials or SSO into your system from theirs.