TL;DR answer is - they are very limited. Some workloads, such as Exchange, can be configured with proper separation. Most of the others cannot. Most of the admin endpoints cannot. So a user with an admin role will be able to perform actions across both companies.
Administrative units is the current "suite-wide" solution. Which is not really suite-wide. Or a solution. Still, it's the only built-in functionality we currently have: https://www.quadrotech-it.com/blog/working-with-administrative-units-in-the-office-365-admin-center/
If that works for you, great. If not, you can either wait for Microsoft to deliver the long-promised suite-wide RBAC controls (in a year or two), or use third-part management products that basically replace the admin endpoints.
