AWS Network Firewall to allow particular Office 365 tenant

That's not something Network Firewall is able to do. First, the traffic between the user and Office 365 is likely to be encrypted. And even if Network Firewall could inspect encrypted traffic, a user connecting to Office 365 isn't going to have a single (or even a few) sessions to one or (a few) servers - it's going to be a lot of different connections that need to be inspected and dealt with as a single entity. That's really difficult.

You might explore tenant restrictions and see if that helps at all.