I currently have a helpdesk project and I am adding a new project for another department, but when I grant them application access to Jira Service Management, they are able to view that helpdesk project. Albeit, it's limited, but they can still view everything.. From closed requests, to internal comments. I don't like that... The only thing that I have seen that I can do to fix the issue is to remove the ability for all users to browse the project... Which that permission is required for using our user picker... If I have to switch the user picker to a standard text field I will, it's just not ideal for what I use it for.
Please let me know if you need more details.. I am sure I am missing some...