How do you restrict browsing a live site to a specific role?

Our content-staging Kentico instance has multiple sites. We want to give certain external parties access to browse particular sites. We want to create a "__SiteBrowser" role for each site, and then add roles to users to give them access.

Setting "requires authentication" on a site's root node gets us part of the way there, but it's not quite granular enough. We don't want all authenticated users to bowse a particular site, but only users of a certain role.