In my experience you just would put the company field on the cmdb form as a mandatory field and whenever a new CI is created the company field would set the domain. MSP users would have a contains/visibility relationship as well as sit above all the domains they manage and thus the MSP users should have access to update all data and report on any data they need while the domain/company defines ownership. You wouldn't need to do anything special if you granted the client access to the instance because they would be scoped to only their domain and thus only see CI's that fall in their own domain. To those users it would seem as if they were the only client using the instance.