Document/Design how Multi-tenancy should work with Crossplane

In a multi-tenant environment, how would a system owner provide Crossplane CRDs to an application team in a safe/secure/easy to use manner?