Possibly the easiest way to set this up would be to set the ASA to transparent mode with policing per IP. The ASA would use one of the public IPs, but you'd need a /29 anyway.
firewall transparent
!
interface Ethernet0/0
nameif outside
security-level 0
!
interface Ethernet0/1
nameif inside
security-level 100
!
ip address 1.2.3.4 255.255.255.0
route outside 0.0.0.0 0.0.0.0 1.2.3.5 1
!
access-list rate-limit-tenant1 extended permit ip any 1.2.3.1 255.255.255.255
access-list rate-limit-tenant1 extended permit ip 1.2.3.1 255.255.255.255 any
access-list rate-limit-tenant2 extended permit ip any 1.2.3.2 255.255.255.255
access-list rate-limit-tenant2 extended permit ip 1.2.3.2 255.255.255.255 any
access-list rate-limit-tenant3 extended permit ip any 1.2.3.3 255.255.255.255
access-list rate-limit-tenant3 extended permit ip 1.2.3.3 255.255.255.255 any
!
class-map rate-limit-tenant1
match access-list rate-limit-tenant1
class-map rate-limit-tenant2
match access-list rate-limit-tenant2
class-map rate-limit-tenant3
match access-list rate-limit-tenant3
!
policy-map rate-limit-tenant1
class rate-limit-nuwave
police input 33300000 10240
police output 33300000 10240
!
policy-map rate-limit-tenant2
class rate-limit-nuwave
police input 33300000 10240
police output 33300000 10240
!
policy-map rate-limit-tenant3
class rate-limit-nuwave
police input 33300000 10240
police output 33300000 10240
!
This gives each of the 3 tenants 33.3Mbps with a small burst. The ASA uses 1.2.3.4 for managment access, and 1.2.3.5 is the ISP's gateway in this example. This does not use vLANs, but they're not necessary anyway. If you did want to use them then you'd have to have separate subnets for each tenant, and would have to operate in routed mode instead of transparent.
I have not tried copying any pasting this code into a default configuration. I believe it's close, but not all that's necessary.