Experimenting site to site VPN between two azure vnets in different tenants

Hi, I am trying to some handons for VNG.

So In my lab setup I have two PAYG tenants and two Vnets, Of which Tenant-2 vnet is designated as Onprem. And Tenant-1 Vnet is considered a cloud vnet that will have the VNG and LNG.

My question is what kind of VPN device will I need in tenant-2, do I need to create another {VNG+LNG} there as well?