Container for every user
Based upon my understanding you essentially have a Data Partitioning problem, in that you need to maintain a degree of separation between each of your customers but also host the service centrally.

You have suggested that you instantiate a Docker container for each of your customers, I think there are a couple of issues with this:


Containers are designed to be somewhat ephemeral, you can use some of the concepts within Kubernetes to effectively create a singleton per customer, however:


Availability will likely be hurt by virtue of it being a singleton if the pod, node or cluster fails then that pod will need to be rescheduled.
The cost is likely to be quite high, as each of those containers will consume some resources regardless of whether they are being used or not.

Depending on how many customers you have, you get into the realms of too many containers:


Orchestrators such as Kubernetes, Docker Swarm and Mesosphere are generally designed to support a large number of containers, however, the expectation is that's lots of the same workload not lots of disparate workloads. Kubernetes has in the past experienced slowdown when lots of ConfigMaps, Pods and CustomResourceDefinitions are deployed.
Whilst lightweight each container will consume system resources, not just Memory, CPU but also TCP/IP pool exhaustion.

Isolation - containers are a good way to isolate workloads from each other, but it's not infallible - Read Containers are not VMs


If I were to approach your problem I would be inclined to use Kubernetes as a Microservices platform hosting your application across multiple ReplicaSets then implement your partitioning at the datastore level in AWS via DynamoDB and EFS.  You are already encrypting your data so you have cryptographic certainty that isolation can be achieved.