Hello,
1.Can creating an header rule to allow BOX?
2.Can restricting access based on tenant ID?

Taking Google as an example,
a. For Primary Destination Value specify "mail.google.com".
b. In the Custom Header field, specify "X-GoogApps-Allowed-Domains".
c. In the Header Value field, specify your domain, or a list of domains separated by commas. For example: www.example1.com,www.example2.com

Thanks you so much