Spartacus can automatically detect existing sites with requesting below URL: https://backend.site/occ/v2/basesites?fields=baseSites(uid,defaultLanguage(isocode),urlEncodingAttributes,urlPatterns,stores(currencies(isocode),defaultCurrency(isocode),languages(isocode),defaultLanguage(isocode)),theme,defaultPreviewCatalogId,defaultPreviewCategoryCode,defaultPreviewProductCode)&lang=en&curr=USD
Spartacus will match current URL with existing website URLs on backaoffice. Check spartacus documentation for details.
You need custom implementation for prevent mixing user sessions. Because spartacus using OAuth2 protocol. You can use UserFilter or others for checking it.
You didn't share your customization so I can't say about your BE works.
If you haven't got any customization, you just need to implement filter for checking user tokens for preventing mixing sites in BE side.