You have yourself quite an interesting project. I've never directly seen anyone try to implement something that large, at least on SQL Server. The more I read your post, the more questions I come up with...
Worst case scenario infrastructure-wise (which is actually the best case scenario, business-wise), you need 10K databases times 2k users. That's 20,000,000 users. You aren't going to be successful in trying to manage 20 M SQL Server logins. IMO. Just the sheer number of them, dealing with moving them from server to server, watching out for ID collisions and mismatched IDs, plus I'm not sure how SQL Server would behave with 20 M rows in sys.server_principals. Additionally, your web app is probably going to want to connect as a single, or very low number of, users. IIS can't pool connections unless their DSN strings are identical. One of the attributes of a DSN string is the user name. Different users means no pooling.
You will need to roll your own user credential scheme. It will have to be able figure out what tenant a user belongs to and then your web code will need to select the proper database. That user metadata is critical, it going to need to be stored somewhere, it's going to need to be clustered or mirrored, it's going to need to be fast and it's going to need to be well-protected (from a security perspective. IOW, encrypt it.). Assuming that SQL is even a good idea here, I would keep this database away from the instances that server tenants. This helps from a security standpoint and from a load standpoint, though I would guess that once a users is validated and the web app is steered to the correct database on another instance, there will not be any more querying of this user metadata related to that user.
Quick question: should two different users, who belong to two different tenants, be allowed to have the same user name?
Another quick question: If I tell you that I work for FuBar, Inc., how do you know that? Is FuBar going to give you a list of users and you give them back a list of user names, or are they going to self-provision?
You are going to need to go multi-instance. If even a fraction of those users decide to hit the application at once, a single instance will melt. It won't have enough worker threads to run all of those requests at once. If only 1000 users hit your instance at the same time, it will probably run out of worker threads and request will start to stack up and wait. I've seen this happen; the proximate symptom is that new connections will not be able to log into the instance because there are no available worker threads to service them. If this is very short-lived behavior, you app might survive. If not, or your app is fussy, users will get errors.
Even if you will not have many tenants to start, you should start thinking about the future and automation because when you see that your server is bogged down and there are 10 new tenants to bring online, it's pretty much too late and your service (and your clients, and your soon-to-be-ex-clients) will suffer until you write your way out of the problem.
You are going to need a way to move databases around, from overloaded servers to lightly loaded (or new) servers. Whether or not you can get a window of downtime will depend on your SLA.
Are you providing a specific application, like SalesForce, or are these databases just containers for whatever your tenants want to put in?
How big are the databases? If they aren't very big, you could just restore from a backup file that provides a template. (This isn't much different than what the model database does, but I haven't seen anyone really use model in a good way since my days with SQL 6.5.) Once the template has been restored to the new database name, you could then customize the new database as necessary for a particular tenant. You can't do the customization before you have the tenant, obviously. If the database is big, you might follow the same basic procedure except you do the restore ahead of time, before any new tenant needs the space. You might keep a couple of these databases around, maybe one per instance. If you keep too many around, this will force you to maybe buy more hardware and/or storage than you need, plus you will have make allowances in your backup/reindex/checkdb maintenance window (or change your code to avoid databases that are 'deployed', but not 'in use'.).
If this is your own app, how are you going to handle updates to the schemas? How are you going to keep versions of the database straight with versions of the code, if you are using a single URL that gets to your web app?
How do you detect and destroy databases that aren't in use anymore? Do you wait until your A/R group says that someone hasn't paid their bill for three months?
If tenants are managing permissions, that implies that they have some understanding of the inner workings of the app, or that your app has a very simple role structure. Using something like Blogger as a rough example, users can (read posts), (read posts and make comments), (... and create posts), (... and edit other's posts), (... and can reset other users passwords), or (... and whatever). Having a role for each of those different sets of rights and assigning a user to one role or another shouldn't be too hard, but you don't want your app running 'GRANT' statements. Watch out for roles that have a hierarchy and depend on inheritance, it can get confusing. If you are promoting or demoting a user, I'd say pull them out of all of the associated roles and then add them back to the one role that they need. Oh, and since you probably can't use SQL's native credential scheme, you are going to have roll your own code here.
I think that I've only scratched the surface here, and this post is already too long. What you really need is a book, or at least a whitepaper from someone who has done this. Most of those guys won't be talking, if they view it as a competitive advantage.