All users associated with a single Auth0 tenant are shared between the tenant’s applications (and therefore have access to the applications).
To keep users separate and restrict their access, we recommend that you create an additional tenant with applications you want groups of users to access.
To restrict users’ access to certain applications, you can use rules.
Inside a rule, the context.clientName and context.clientID variables are available to check which application the user is using for login.