How to on Multisite manage users over 1 site
LDAP, you should define in an external directory (openldap, AD or whatever) which website a user can access or not and define rules inside each website (mapping rôles/sites/ldap properties, more infos here).
From there, you can add SSO like CAS.