How to signup for subdomain of a multisite

I would like people who register on a subdomain of my network to only be only a member of that subdomain (which is masked with a mapped domain).

Right now when someone signs up, they are members of that subdomain and the root domain. I can manually remove them from the root domains user list and they will still have access to the subdomain so it seems technically possible for a user to exist outside the root domain but I would like to find a way to not have to manually update each user.