Is seems that Domain Strict, a Domain Access submodule, may help you, as stated in this issue:
DA is a node access module (which is designed to enhance what 'access
content' means), and you should be able to do this now by using Domain
Strict and configuring user behaviors.
Domain Strict forces people to be members of a domain in order to view
its content. You would enable the module, then you will note:
1) Anonymous users cannot access any content. This is because they
cannot be assigned to a domain (since thiey have no account).
However, you can use the User Defaults setting page to assign
anonymous users to the primary domain.
2) Use the same User Defaults setting to assign all 'authenticated'
users to the domain(s) you prefer.
Under this setup, anonymous users would still have the 'access
content' permission, but can only see nodes posted to the primary
See section 4.10 of README.txt and the README for Domain Strict.
Check also README.txt from Domain Strict.
[Domain Strict] it changes the default Domain Access behavior. This
module makes the grants given to a user specific to the domains that
the user is registered to see.
You'll have to deal with User Defaults setting to set permissions for anonynmous users since initially they don't have domain assigned.