Your login page is the bastion

Every customer has their own container, and your app already knows who is logged in. Those two facts can meet.

The proxy accepts a JWT group: your application's existing signing secret, the token read from the Authorization header. Set the customer's container to grant http on the app's port, deny terminal and files, default deny. Now the session token your login flow already issues opens exactly one container: theirs: and the checking happens in the proxy on your own server.

No second identity system. No access product bolted in front. No VPN invitation for customers who just want their instance. Revocation is your session expiry, which you already have.

The proxy speaks the auth your app already issues.