You would need to set
Publishing.CheckSecurity to be
true to prevent users from publishing content that they don't have access to (Items will be published only if the user have write access, and will be deleted if the user have delete access)
<!-- PUBLISHING SECURITY
Check security rights when publishing?
When CheckSecurity=true, Read rights are required for all source items. When it is
determined that an item should be updated or created in the target database,
Write right is required on the source item. If it is determined that the item
should be deleted from target database, Delete right is required on the target item.
In summary, only the Read, Write and Delete rights are used. All other rights are ignored.
Default value: false
<setting name="Publishing.CheckSecurity" value="false" />
I would recommend you have workflow enabled on your content, you can have different workflow for each site, this will restrict publishing content that has not been approved yet, it would also help if your workflow has an auto publish action when the item is approved.