Yes, access controls is definitely a way to do it.
We are still exploring if we can run completely independent installations. The data is of sensitive nature - so keeping it completely walled off has its perks.
Another idea could be to run multiple docker containers and map them to different ports. That should work, right? Though, I would still very much like to stick with JARs, instead of using docker - let me know if you think of any way to do that.
Anyway, thank you so much for your help. Really appreciate and admire your work.