This is indeed the case -- each autonomous community is setting its own rules regarding COVID passports, closures, curfews, etc. For example, the Valencian Community is planning on implementing the use of the COVID passport in restaurants, bars, gyms and theaters; Catalonia is looking to set a curfew and close nightlife [both links in Spanish], whereas the Community of Madrid is likely to have less stringent restrictions based on the regional government's general politics/policies.

I think some policies, such as requiring the use of masks outdoors, can only be set by the central government (based on articles like this), but in general curfew/COVID passport/closure/gathering-type restrictions can be set by each autonomous community.