A private discussion can be seen by your support staff and by the people taking part in it: the customer who started it, anyone following it (its watchers) and, if the customer belongs to a company, the rest of their company. How a customer gets in depends on whether they have an account.
Customers with an account
They log in, and find the discussion on their profile under Discussions you watch (or follow the link in any email about it, which asks them to log in).
Guests: the private link
Someone without an account can start a discussion too, from your site or by email. They're a guest: Tender knows them only by their email address. To let them back in, the emails Tender sends them about a private discussion link to it with a secret token at the end:
https://yoursite.tenderapp.com/discussions/billing/12-invoice-question?anon_token=3f9a…
Anyone with that link can read the discussion and reply to it, so it works like a password. As long as it isn't shared, only your staff and the people in the discussion can see it. The token belongs to the discussion: a link that's missing it, or has another one, doesn't open it. Guests who started the discussion on your website can also get back in from the same browser without the link.
If a guest forwards a notification email, whoever receives it can open the discussion. If that's a worry, you can invite the customer so they log in instead.
Public discussions
A public discussion can be read by anyone who can see your site, so it needs no token. See Locking down your Tender for keeping discussions private by default, and for which attachments on public discussions only your staff can download.