How to give different permissions for different domains
Is seems that Domain Strict, a Domain Access submodule, may help you, as stated in this issue:


  DA is a node access module (which is designed to enhance what 'access
  content' means), and you should be able to do this now by using Domain
  Strict and configuring user behaviors.
  
  Domain Strict forces people to be members of a domain in order to view
  its content. You would enable the module, then you will note:
  
  1) Anonymous users cannot access any content. This is because they
  cannot be assigned to a domain (since thiey have no account).
  
  However, you can use the User Defaults setting page to assign
  anonymous users to the primary domain.
  
  2) Use the same User Defaults setting to assign all 'authenticated'
  users to the domain(s) you prefer.
  
  Under this setup, anonymous users would still have the 'access
  content' permission, but can only see nodes posted to the primary
  domain.
  
  See section 4.10 of README.txt and the README for Domain Strict.


Check also README.txt from Domain Strict.


  [Domain Strict] it changes the default Domain Access behavior.  This
  module makes the grants given to a user specific to the domains that
  the user is registered to see.


You'll have to deal with User Defaults setting to set permissions for anonynmous users since initially they don't have domain assigned.