You have two options:
Domain Access has it figured out
Domain Access module excerpt:
The Domain Access project is a suite of modules that provide tools for running a group of affiliated sites from one Drupal installation and a single shared database. The module allows you to share users, content, and configurations across a group of sites such as:
- thisexample.com <-- can use any domain string
- example.com:3000 <-- treats non-standard ports as unique
Then, you need Domain Roles:
Allows you to save user roles per domain. Allows a certain user to be just authenticated on one domain and admin on another etc.
You can't totally prevent cross-logins, but you can make user logged in with no permissions at all, except to log out.
If you prefer Multisite approach
You can change the settings for the access to the database that are contained in the settings.php file used by your Drupal site to something similar to the following one (replace the values between brackets with the correct values for your site):
$databases['default']['default'] = array(
'driver' => '[Your database engine]',
'database' => '[Your database name]',
'username' => '[Your username for the access to the database engine]',
'password' => '[The password for the access to the database]',
'host' => 'localhost',
'prefix' => array(
'default' => 'main_',
'users' => 'shared_',
'sessions' => 'shared_',
'role' => 'shared_',
'authmap' => 'shared_',
'collation' => 'utf8_general_ci',
Taken from this answer.
Then, in hook_user_login(&$edit, $account) test if user has a role he needs to access given page, and if not, logout him with proper message.