Sub account access to selected domain only

Can we have a sub-account to give someone access to specified domain only?

Or, do I need to create a separate account and log-out-in to switch between them?

You’ll need a separate account.