One thing you can do to extend your current system is to hack the page that performs the registration to programatically put a user in the correct group based on what subsite they are in right now.
You could then also in the login verification page check that they are in the correct group.
That is all simple, but leaves you with a nasty special case whenever a member of one site tries to join another one. Maybe you could catch that scenario and present them with a page saying "you are already a member of xyz sites - would you like to extend your membership to include site abc".
It's a bit hackish, but just came off the top of my head fwiw.
