Control external access on tenant level

Question

We are working with many customers accessing our sites. Our PO wants to make 2 groups, where clients from @xyz.com can only view content on your sites, but cannot download the files, regardless their site-level acces. So, even if the site owner puts them in the members group, they should only get this limited view.
There would be another group with thrusted clients, who could get normal read rights. This should act as an upper limit, so of course, the "limited view only" group should not get per default view rights for every site. Is this possible? I found options how to do this per site (grant "view only" permissions instead of "read"), or disable Offline Client Availability, but I need to control this on tenant level.

Answer 1

This setting is not available Tenant Wide. You will need to set this up for each site collection (the highest level).