Our previous method for creating guest users was to grant them application access through a specific group, and then only give that group access to the project they needed to see. However, we've discovered that new Next Gen software projects, by default, are open to everyone in our directory, regardless of group. Even if we restrict all of our current projects, this doesn't solve the default behavior of new projects being open to everyone. So what we need to do is create guest users that don't count as part of our company for permissions purposes, and thus don't have access to any new projects that might get created under the default permissions. How can we do this?