1. Proposed title of this feature request

Add tenancy support to (B)AdminNetworkPolicy

2. What is the nature and description of the request?

As a cluster admin, I want to setup an overridable deny-all policy to protect namespaces by default.
At the same time I want to build tenants in my cluster and allow connections inside one tenant by default.

3. Why does the customer need this? (List the business requirements here)

Simplify the network policy management. Currently, it's one Tier2 NetworkPolicy per namespace, most of the use case can be handled with ANP except this one.

Upstream ANP tracker https://github.com/kubernetes-sigs/network-policy-api/issues/122