The user names are defined 'globally', but the security is saved by data set. This is to allow exactly what you want to do; have a user access one data set but not another.

What you need to do is define a security group that will be designated for training, in the 'Training' data. Do not create this same security group in your real data. If the 'trainee' accidentally tries to login to the live data, they will get some sort of warning message and won't be able to get in.

Regards,