Tenants are separated logically, with users, identity providers, and applications all separate.
If you need physical or geographic separation (for instance, to host users in tenant A in the USA and users in tenant B in Germany, you can do this by running two instances of FusionAuth. You can keep system wide configuration in sync using scripts with the client library.
User ids need to be globally unique. You can either provide your own unique uuid or you can let FusionAuth provide them for you. But these values are not tenant scoped.