There's nothing wrong with the system, but the default "open" setup is definitely an issue (I'd call the scheme a flaw as it breaks so many people's setups)
You'll need to unpick the default first. The default is to have a group called "confluence users", which is used to say "this person can log in". In itself, this is fine. The problem is that this group is then used for other things, such as "can read/write spaces by default".
What you need to do is either
1. Remove all usage of the group in spaces and permissions (most importantly, the default ones, so you don't inherit more when creating new spaces), replacing it with something that still lets the desired users in
2. Create a new group like "confluence login", add ALL your current users to it, then nip into global permissions and change the "can use" from "confluence users" to "confluence login". Then, don't put your restricted user(s) in confluence users...
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.