Limit connection to specific database with AlwaysOn Primary
There's not a straightforward, built-in way of accomplishing what you want to do beyond what you suggest at the end of your question:

besides the obvious use two logins with different permissions

I've heard of folks doing something like this:

create a SQL Server Agent job that runs once every X seconds (might be 1, 5, 15, etc depending on your requirements)
in that job, check to see if we're running on the primary replica for this database (sys.fn_hadr_is_primary_replica OR the AG DMVs)
if it is the primary, query sys.dm_exec_sessions to see if that login / user is connected ( in the login_name)
if they are connected, check to see if they are using the off-limits database (in the database_id column, or pull the query text and check that)
if they are using the off-limits database, use the kill command on the session_id

It's not perfect (because the job is not continuous, and because it's hard to check if the off-limits is being used conclusively), but it's better than nothing (if you're stuck with the single login approach).