Some nodes served headless Drupal and some nodes served with Drupal
Take a look at the Permissions by Term module.  You can add a term field that defines the site(s) the node is accessible by and limit access to content authors on the main site.

Your API for the microsites can use this to limit access by site as well.

If that one doesn't work, it's description lists another module that might work.