You should be able to do that by creating only the user on the "Site 1" not on both.
This way, the user can only view the reports on "site 1"
If you haven't set any permission for user on default site, the user is with the default settings.
Please check the default settings or set "no permission" for this user on default site.
I cannot uncheck them from default site, if unchecked the user cannot login. I am using ldap authentication.