I have Non-Profit Registered License TS3-server, with two virtual TS-servers running. Now I would like to create server-query account, but limited to querying just one of those virtual servers. How can I make it?

I know how to create server-query login, but how can I restrict it so that it may query only one of those virtual servers, and not the other one?

And one more question: Has every virtual TS-server its own query-port, or is there only one common query-port?