You are right, I updated my previous answer: at “Additonal Modules” tab.
Correct: while plugin is network activated you have one global for the whole network default access error message.
If you network deactivate plugin and activate it individually for selected subsites, you can have individual for every subsite settings.
Other option – input custom shortcode as a network global access error message template. Then built a message individual for subsite inside a PHP processing that shortcode.
