There is more than one way of doing this. The way I choose, helps to self document the link and I use a psudo DDI number based on the customers actual DDI number. Let me try to explain...
I will describe one direction (PBX1 to PBX2). The real DDI belonging to the tenant (customer) on PBX2 is 01636123456.
Put the IP address of BPX1 into the Domains ACL on PBX2.
Next, make an outbound route on your chosen tenant on PBX1, I chose a prefix of 82, followed by the three digit extension number of the device on PBX2. I give all the psudo DDI numbers a prefix of 88. Notice the bridge statement is connecting to 88<customer DDI><ext> on the port (5080) associated with the external SIP profile on PBX2.
The outbound route above will drop the call into the public context on PBX2, so we now just need to create an inbound route:
... And that's all there is to it. Customers can make sense of the CDR records that using it produces, and if you set up the reverse direction with the prefix 81 (as set up in the 82 outbound route) in the outbound route, then there is no confusion in making a return call.
I hope that makes some sense, I'm sure you can modify or adapt the concept to fit your needs.
Adrian.