There are three steps to this.
- Create a logical system
- Create a user class bound to the logical system
- Create a user with the class
Here is a very incomplete example:
set logical-system lsys1
set system login class lsys1-class logical-system lsys1
set system login user lsys1-admin class lsys1-class
Obviously you need to configure the rest of the parameters for the logical-system as well as any additional class or user authentication and authorization.
By simply assigning a user to a class assigned to a logical-system you are restricting the user to the lays.
The master administrator can assign one or more system administrators to each logical system. Logical system administrators are confined to the context of the logical system to which they are assigned. This means that logical system administrators cannot access any global configuration statements. This also means that command output is restricted to the context to which the logical system administrators are assigned.
For more, here's a link to Juniper's documentation on configuring users and permission levels for logical systems.