A cloud provider hosts thousands of tenants on shared physical infrastructure. During a design review, the security architect must ensure that each tenant's virtual network traffic remains logically isolated from other tenants across the same underlying physical switches, even though many tenants reuse overlapping private IP address ranges (e.g., 10.0.0.0/8). Which infrastructure approach BEST achieves this isolation at the network layer?