For clarification, each customer-facing port will be configured as a Q-in-Q port and your core-facing port will carry a selection of S-VLANs, each with one or more C-VLANs, correct? Also, when you say "single L2 VPN instance", do you mean each S-VLAN (outer tag) will be put into its own individual L2VPN instance? I would guess that's what you mean, but want to make sure.
There shouldn't be any issue with this on MX or even M-Series with IQ2 PICs. Depending on how you have your L2 circuits or VPNs configured, you may need to use VLAN manipulation on the MX port(s) to the switch:
If you're asking about what hardware you'll need, any MX would do, but you'd likely want to get a DPC (not recommended, as it's older kit) or an MPC/MIC combination that supports per-unit scheduling to maintain QoS on each logical unit.
Assuming you have LDP or RSVP LSPs configured, this is a typical setup we use on the MX:
set interfaces ge-1/1/1 encapsulation flexible-ethernet-services
set interfaces ge-1/1/1 mtu 9192
set interfaces ge-1/1/1 unit 10000 flexible-vlan-tagging
set interfaces ge-1/1/1 unit 10000 encapsulation vlan-ccc set interfaces ge-1/1/1 unit 10000 vlan-id 130 set interfaces ge-1/1/1 unit 10000 family ccc
set protocols l2circuit neighbor 192.0.2.10 interface ge-1/1/1.10000 virtual-circuit-id 1122 set protocols l2circuit neighbor 192.0.2.10 interface ge-1/1/1.10000 description customer-a set protocols l2circuit neighbor 192.0.2.10 interface ge-1/1/1.10000 mtu 1600 set protocols l2circuit neighbor 192.0.2.10 interface ge-1/1/1.10000 encapsulation-type ethernet set protocols l2circuit neighbor 192.0.2.10 interface ge-1/1/1.10000 pseudowire-status-tlv
The other end of the pseudowire is exactly the same, just with the opposite end's loopback specified as the neighbor. There doesn't seem to be a requirement to separate traffic out by C-VLAN, so all C-VLANs would be dumped into this L2circuit unmodified.
Now if you happen to have mis-matched VLANs on either side, you would simply perform some VLAN manipulation on either end. Let's say you have S-VLAN 130 configured on the A-side and S-VLAN 250 configured on the Z-side, the configuration would be the same as above with something like the following:
set interfaces ge-1/1/1 unit 10000 input-vlan-map pop
set interfaces ge-1/1/1 unit 10000 output-vlan-map push