Each machine authenticates to the domain controller of the domain they are logging into, based on which controller responds first... it does cost metrics for this...
If you want to "isolate" this for whatever reason...you need to segment this at the switch level..so that clients will only see the bdc that you want them to see, but you have to ensure the bdc can still see the PDC in a backbone, etc for replication/sams maintenance, etc.