There’s an ambiguity in what you’ve said so far. Do you mean that when viewing a discourse post with a Drupal link, the onebox preview should depend on
- the viewers Drupal access; or
- the creators Drupal access
Either way, it’s going to be easier to address if you can make it a discourse access issue. You can get automatic discourse group assignment based on Drupal role, that should be easy enough with the Drupal discourse SSO module.
You may also find you need some custom access logic on the Drupal end to make sure the onebox preview crawler can access restricted content.