One installation, many books, isolated by design.
Every document and every event carries its tenant.
One database, one set of code, and the data layer discriminates every read and write by tenant. A tenant is data: creating one needs no schema change. A bank runs one tenant. A partner runs one installation with a tenant per customer. A bank that wants a database to itself gets a separate deployment, not a special case inside one.
What this means for you: a second customer is a second tenant, not a second installation. Your cost to serve customer twenty is close to zero.