This use provides each tenant with one or more private networks, which connect to the outside world via a Quantum router. The case where each tenant gets exactly one network in this form maps to the same logical topology as the VlanManager in Nova (of course, Quantum doesn't require VLANs). Using the Quantum API, the tenant would only see a network for each private network assigned to that tenant. The router object in the API is created and owned by the cloud admin.
This model supports giving VMs public addresses using "floating IPs", in which the router maps public addresses from the external network to fixed IPs on private networks. Hosts without floating IPs can still create outbound connections to the external network, as the provider router performs SNAT to the router's external IP. The IP address of the physical router is used as the gateway_ip of the external network subnet, so the provider has a default router for Internet traffic.
The router provides L3 connectivity between private networks, meaning that different tenants can reach each others instances unless additional filtering (e.g., security groups) is used. Because there is only a single router, tenant networks cannot use overlapping IPs. Thus, it is likely that the admin would create the private networks on behalf of tenants.
