How to implement external roles to limit access together with internal roles for many projects

[Bob]

This question is related to Jira Cloud.

I've read in Jira documentation that Project Roles may be more flexible than Groups when you have multiple projects, some that have external users whose ability to browse projects needs to be limited to a single project. 

Assuming that the core team can use the default Jira project scheme and the default project role of Developer, they become my "internal" Jira users...

What steps should be taken to create a project role for say, customers, who need to be able to work on the same project as my internal Jira users, but need to be restricted from viewing and making any changes to other projects that my internal Jira users?