NATS cluster with internal subjects and communication between clusters

[smolp]

I have two nats clusters in two locations.
I want some topics to be internal in a local cluster so I don't want to send data to the other one. Internal topics must have the same name in each cluster.
Additional constraints would be to not change the name of the inbox topics, so a topic like private.reply.something1 won't be changed to _R_.something2.

I tried something like this:

c1.conf:

port: 4222
monitor_port: 8222

accounts: {
  PUBLIC_A: {
    default_permissions = {
      publish = ["internal.a"]
      subscribe = ["internal.a"]
    }
    users: [
      {user: public_a, password: public_a},
    ]
    exports: [
      {stream: >}
      {service: >}
    ]
  }
}

authorization {
  default_permissions = {
    publish = ["internal.a"]
    subscribe =[ "internal.a"]
  }

  ADMIN = {
    publish = ">"
    subscribe = ">"
  }

  USER_A = {
    publish = "external.a"
    subscribe = "external.b"
  }

  users = [
    {user: admin_a, password: admin_a, permissions: $ADMIN}
    {user: user_a, password: user_a, permissions: $USER_A}
  ]
}

leafnodes {
  port: 7422
}

c2.conf:

port: 4222
monitor_port: 8222

accounts: {
  PUBLIC_B: {
    default_permissions = {
      publish = ["internal.a"]
      subscribe = ["internal.a"]
    }
    users: [
      {user: public_b, password: public_b},
    ]
    exports: [
      {stream: >}
      {service: >}
    ]
  }
}

authorization {
  default_permissions = {
    publish = ["internal.a"]
    subscribe =[ "internal.a"]
  }

  ADMIN = {
    publish = ">"
    subscribe = ">"
  }

  USER_B = {
    publish = "external.c"
    subscribe = "external.d"
  }

  users = [
    {user: admin_b, password: admin_b, permissions: $ADMIN}
    {user: user_b, password: user_b, permissions: $USER_B}
  ]
}

leafnodes {
  remotes: [
    {
      urls: [
        nats-leaf://c1:7422
      ]
    }
  ]
}

So the idea is to have user public_a to share data with admin_a and user_a and for public_b to share data with admin_b and user_b, and that public_a never shares data outside cluster 1 and public_b never shares data outside cluster 2. Unfortunately, the users don't see messages from public_a or public_b.
Is it possible to "share" data from those public accounts to users inside the authorization block in the cluster?
Is this approach correct?

What I want to achieve is similar to this question.

[derekcollison]

I would suggest connecting the clusters via leafnodes. Then you could only connect the account you want data to flow, and can move internal comms to a different local account that is not connected via leafnodes. Or, you can put permissions directly on the leafnode that deny's pub and sub for internal.>.

[smolp]

I think that in the first case, if I asked for something from external.c on user_a, the reply topic would get changed to _R_.something, wouldn't it?
The second option seems more promising, but I don't see any permissions block inside the leafnode configuration. Can I configure it without using accounts?

[derekcollison]

In the remote leafnode block for each solicited leafnode you can specify deny_export and deny_import which can be a single subject (optionally with wildcard) or a list of them, e.g. ["foo", "bar.*"]