With Mara it is quite permissible to host a number of sites in subdirectories of the same hosting space, in fact this is frequently necessary for testing purposes. There is no specific need to access the sites via a subdomain.
It is also possible to host a complete subsite within the directory structure of a main mara site, the subsite having its own codebase, menus, styles, etc. This is sometimes convenient when you wish to publish a 'minisite' carrying information about a specific product, with a completely different style from the main site.
Where multiple Mara sites exist in the same webspace, the Mara site which a page belongs to is determined by which copy of codebase/reflex.php is called by the shebang or PHP auto prepend directive -whichever method is used.
Naturally you can also use subdomains to access your subsites, if you prefer. The setup is identical except for the DNS requirements.
A given page can only 'see' items in the file manager down to one level below the codebase folder -Which will normally be where the webpage is located. Of course there is no actual security to prevent a page from accessing content elsewhere in the folder structure. It is simply that the Mara file manager will not offer such content for inclusion. To physically prevent one site from accessing content in another you would need to use virtual hosts, preferably with different server accounts and the Apache suPHP feature active. (This is true regardless of the CMS used)
The login process requires that the session cookie is unique to each site hosted on the same domain. Otherwise, logins will clash. Therefore if you are not using subdomains, you should change the cookie string in sitecfg/siteini.php to make each cookie unique. This only matters if two sites will be administered at once from the same browser, so for development work it can generally be ignored, but for multiple production sites it is important.