I need some clearance about licensing requirements.
You noted: If you configure cross tenant access policies to restrict access to only a few organizations this requires Azure AD P1.
Docs https://docs.microsoft.com/en-us/azure/active-directory/external-identities/cross-tenant-access-overview#important-considerations and https://docs.microsoft.com/en-us/azure/active-directory/external-identities/cross-tenant-access-settings-b2b-direct-connect#to-change-inbound-b2b-direct-connect-settings note: To configure trust settings or apply access settings to specific users, groups, or applications, you'll need an Azure AD Premium P1 license.
If i didn't miss anything in the docs, i can set organization-specific settings without AAD P1, as long as i do not apply trust settings (e.g. MFA-trust for guests) or target users/groups/apps.