Tenant user role
This role is created automatically upon installation of Moodle Workplace. It is assigned also automatically to the absolutely all tenant users in the context of the tenant's course category.
This role by default only allows one capability moodle/category:viewcourselist. As mentioned in the Moodle Workplace Installation page, this capability is also removed from Authenticated user and Guest roles. This means that users from one tenant can only browse courses in the category of their tenant but can not browse courses anywhere else.
In some installations the site administrator may decide to allow more capabilities to this role, for example, request course creation.