Yes, under administrators, you can create a profile and apply that to users under their respective domains. Of the user is assigned to a domain, but not the admin domain, when they login they are directed directly to their domain and can't see outside of it. At the same time, only the privileges assigned to them under that domain will apply and you can prevent them from doing whatever you want.