Deploy workloads for different clients to dedicated sole‑tenant nodes so each workload runs on physically separated hardware.

To ensure workloads run on physically separated hardware for different clients, you must target specific sole-tenant nodes. Node affinity labels are the correct mechanism for this. By using node affinity labels based on the node name, you can precisely place a Compute Engine instance onto a particular sole-tenant node. This guarantees physical isolation. Using network tags (options 1 and 2) is incorrect because network tags are used for network configuration (like firewall rules), not for instance placement on specific hardware. Using node affinity labels based on the node group name (option 3) would place the instance within that group, but not necessarily on a specific node, which is required for dedicated physical separation per client.