Dedicated Instances are the correct choice because they place EC2 instances on hardware dedicated to a single AWS account and they meet the audit requirement for single tenant hardware while remaining more cost efficient than host level allocation.

Dedicated Instances run EC2 workloads on physical servers that are dedicated to your account which satisfies the single tenant mandate and they do not require the detailed socket and core allocation or the placement controls that Dedicated Hosts provide so they are simpler to manage and typically cheaper when you only need isolation.

Dedicated Hosts allocate entire physical servers to you and they give you host level visibility and control which helps with bring your own license requirements and affinity but they usually cost more and are unnecessary if you only need single tenant isolation.

On-Demand Instances describe a billing model where you pay for compute by the hour or second with no long term commitment and they do not guarantee that instances run on single tenant hardware so they cannot meet the audit requirement for isolation.

Spot Instances provide discounted spare capacity that can be reclaimed by AWS and they do not provide single tenant hardware guarantees so they are not suitable for compliance that requires dedicated servers.

Full AWS Practitioner Certification Question