Granting Read access to Replica database (via data guard) but need to restrict the same login in production Database
I think you can achieve this by using SQLNET.ORA file found under either in $ORACLE_HOME/network/admin or $GRID_HOME/network/admin or anywhere pointed by TNS_ADMIN variable. 

tcp.validnode_checking = yes
tcp.invited_nodes =&lt;list the valid nodes here&gt;


Details are well explained in a blog written by Arup Nanda

If it is for application, you can restrict access by defining SERVICE_NAME of a standby database in TNS Name. 

You can also create a logon trigger that will check the name of the user and the ROLE of the database. If the database role is not the 'PHYSICAL_STANDBY' then you can raise an error.