I think the real feature you want is a icense to Logical systems (only on SRX) that create a logical SRX inside the chassis that can easily be sub-managed by a user account.
With your current setup, the situation is slightly more complicated. You would need to create a customer user class and then restrict that class to the routing-instance hierarchy as desired.
http://www.juniper.net/techpubs/en_US/junos14.2/topics/task/configuration/access-login-class.html