Thank you for your answer! - I put jboss-ejb3.xml (with above content) to WEB-INF folder and it works as expected!!
But shouldn't do "@SecurityDomain" (at EJB level) the same as jboss-ejb3.xml (as also mentioned in https://community.jboss.org/thread/177728)?