For our Zabbix, we have two separate LDAP servers. One is for company users, the other is for subcontractors. The user accounts are fully separated, one server does not contain any information from the other.

We have the internal LDAP cluster set as the default one. When a subcontractor tries logging in for the first time, they get a simple failure message. To amend this, we have to temporarily switch the default server to the subcontractor one, let the person login (which provisions the account), and then switch it back.

For a better workflow, Zabbix could sequentially query all servers for the user, stopping on success or at the end of the list.