How to restrict multi-tenant MySQL database?
The simplest answer is probably: give each portal a different MySQL database, with a different login and password.

The next-simplest answer is: put each portal's stuff in a separate table.  Review your code carefully to ensure that each portal can only access data in its own table.

If you don't want to change your database schema, the pragmatic answer is: When the code for your portal application sets up a MySQL connection, the first thing it should do is create a view.  Define the view so it provides access to only the subset of the data associated with that particular portal.  You can define the view using a SQL statement with a WHERE clause of the form WHERE portalid = xxx (replace xxx with the id of the currently running portal).  e.g.,

CREATE VIEW webserviceview
AS
SELECT *
FROM webservice
WHERE portalid = xxx


(fill in xxx with the currently running portal).  Now make sure that all of your code only accesses webserviceview and never accesses the webservice table directly.

When a user logs in, you can use the same idea to further restrict access.  Create a view that has only the data for the currently logged-in user.  e.g.,

CREATE VIEW currentuser
AS
SELECT *
FROM webserviceview
WHERE customerid = yyy


Then make sure that your code only accesses the currentuser table, never the webservice or webserviceview table.

If you want to read some research papers that take this sort of idea a bit further, check out the following papers:


Diesel: Applying Privilege Separation to Database Access, ASIACCS 2011.
CLAMP: Practical Prevention of Large-Scale Data Leaks, IEEE Security &amp; Privacy 2009.
Nemesis: Preventing Authentication &amp; Access Control Vulnerabilities in Web Applications, Usenix Security 2009.