Asterisk will only use the first matching definition. Hopefully it will use a type=peer match, and type=peer is likely to be more secure, but there is nothing in your trunk definitions about the user part of the request URI, so Asterisk only has the IP address to go on and will use the “first” section that matches on that. First refers to the position in the internal data structures and may not reflect the order in the file.
That basically means you have to discriminate based on the Asterisk extension that appears in the incoming request.
In a traditional, analogue, or ISDN, system, you would have a single trunk that was shared across all your incoming numbers. (Although I doubt that direct in dialling is still offered on analogue connections.)
Note that username= was deprecated in favour of defaultuser=, a long time ago, probably because it was misleading people to think it had a role for incoming calls.