Isolating access to tenant data in a multi-tenant database
I would probably provision "tenant support identity" (user or role) and have process where a support engineer is provisioned access to a single tenant, through temporary membership in the role, or by giving the support person the password to a temporarily-enabled user.  

The developers would add stored procedures that manage the tenant support identity, along with perhaps some auditing.

Then the only difference between a single-tenant and multi-tenant database is that you have to implement RLS for the tenant support identity.