I see.
Then, you'll need several server services (ports so, too) in the stunnel configuration, each one allowing only one certificate matching with the one set locally and verify level 3.
Then, I can't help here. You'll need a separate app in the middle to allow only one username and password that could pass to the DB app if correct, as well as the rest of data traffic.
I understand now what you want but it's a bit hard, I think. Secure, but not easy :) But, well, that's security :)
It's my point of view. If anyone has solutions or ideas post them. We all will be interested too.
Regards.