Granting Read access to Replica database (via data guard) but need to restrict the same login in production Database We use Data Guard to replicate production Oracle database. We have a need to grant read access to replica DB and at the same time need to restrict that same login gaining read access to production. 

Since the data guard replicates everything (including user/roles) is there any way we can apply this restriction to the production databases? Should I look into to database server inbound port restrictions? Any thoughts on this are greatly appreciated.
I think you can achieve this by using SQLNET.ORA file found under either in $ORACLE_HOME/network/admin or $GRID_HOME/network/admin or anywhere pointed by TNS_ADMIN variable. 

tcp.validnode_checking = yes
tcp.invited_nodes =&lt;list the valid nodes here&gt;


Details are well explained in a blog written by Arup Nanda

If it is for application, you can restrict access by defining SERVICE_NAME of a standby database in TNS Name. 

You can also create a logon trigger that will check the name of the user and the ROLE of the database. If the database role is not the 'PHYSICAL_STANDBY' then you can raise an error.