we have a lot of small customers with a couple of branch offices (~5 clients, no servers). There is no infrastructure and they don't have any IT personnel. For administrative reasons we would like the clients to be part of a domain. We have a root forest/domain in place and would like to add customers to our infrastructure. Since Active Directory isn't designed for multi tennancy, we are currently evaluating trust relationships. For this to work it is important that customers cannot access/enumerate others customer's ADs.
With this in mind, which of the following scenarios would work and what would probably be the best?
a) separate forests
b) one forest, separate domains
c) one forest with child domains
Additionally it would be nice if we could use a single exchange organization. Any advice is greatly appreciated.