Add user creation constraints on tenant