Granting access only to standby database
You could do an OS firewall on the production side, but that wouldn't work if they need production for more limited purposes.  
An after logon database trigger would work, but unfortunately it would also have to run on the primary to disconnect the sessions there.
You could make it part of your procedures to alter the password on the primary of the user they will use to connect the standby immediately after the standby is opened read-only but before the users are notified of the new password.  In that way they will be able to connect to the standby, but will not be able to connect to the primary.  The password just set for the primary would then be the password you delivered to them after the next open of the standby.
You could enable the user just before the standby is opened and then disable the user immediately after before the users are notified that the standby is open.  This would allow the password to stay the same, but does introduce a window of vulnerability that you may be able to mitigate if you have an outage window on the primary and can bring down the listener or something.