High level architecture for cloud/iot solution with multiple customers/users

Question

We're at the early planning stage for a new cloud IOT solution and i'm looking for some guidance or direction for the high level architecture for our use case:

Assume we sell 10,000 edge devices to various customers which all connect to the cloud:

1. As the manufacturer, we would like to gain insights from all devices (a read-only subset of APIs).
2. Our primary customers may purchase 100's of devices, and their support departments will need full read/write access to all devices that they have purchased
3. The end users of the devices may need full read/write access to a further subset of devices (ie the devices assigned to their department)
4. Customers must not have access/visibility of any other customer devices
5. (Bonus requirement) Some customers may purchase a support package from us (the manufacturer) which will allow us controlled read/writer access to their devices

I imagine this is a relatively common use case, but i can't find much about it when reading about the various offerings from Amazon, Google, IBM etc.

So, is this something that can be implemented within existing offerings? Or do we register all devices in one cloud, and then use a seperate system to manage our customers/users and their relative access permissions?

Security/privacy is one of my concerns and this has been addressed very thoroughly by each of the cloud providers, but this could be easily compromised by an additional system managing user access control policies.

I appreciate any feedback or direction.