Every subsite under WordPress multisite stores its roles separately.
It’s possible to manage all roles at one place – main site. When you go to Network admin->Users->User Role Editor, you work really with roles from the main site. “Update Network” button there allows to replicate all roles from the main site to all other subsites.
If you plan to give permission for user to selected site only you may use WP built-in UI: Network admin->Sites: select site, click ‘Edit’ link, open ‘Users’ tab, add existing or new user, grant him needed role. User will have this role at this site only.
URE does not offer such way. Every subsite has own list of pages and/or categories. You can restrict access to them on per site – per page/category basis only.
Right, ‘Update Network’ overwrites all roles at subsites with exact copy from the main site. It’s intended for the case when you have identical roles at all subsites. If you plan to have different roles between subsites you should not use ‘Update Network’.