Hi ,
From my point of view , the easiest way to solve this is to set a search filter on the OU
corresponding to the tenant on each phone.
Can you modify the software on the phone ?
The other way could be by creating a 389 plugin that add a filter on the good OU
regarding the DN of user which make the call to the ldap.
Rgds