Single tenant - multi domains - site/permissions structure

Well, unfortunately it's not possible to have a "dedicated" SharePoint site per domain so if you create a new site collection in your tenant you can basically add any user that is in your tenant...so i'ts just a question of governance. With a good governance plan well know by everybody and also configuring your sites so it's not possible to share information with people that is not part of the site I think you could have it working

https://www.petri.com/disabling-document-sharing-users-no-access-spo-site