For sharing subnet between VRFs, your only option is to configure the subnet under EPG as a provider. Then you can export a contract to another user tenant, unless common tenant is used, then no contract export is needed.
If you want to share a subnet that's defined on an external firewall, you can VLAN tag and do either L2 BD extension or L2 EPG extension. I find that L2 EPG extension is much easier to implement, L2 BD extension is a cleaner solution and provides a bit more flexibility.
Leon
