The easiest solution would be to separate them into different services for each client. Alternatively, you will require to expose all the methods (OperationContract) then do an authorization check on method level to check whether the client who is accessing has sufficient permission to actually call it or not.