How do I curate external user access to see only one project?

Question

In my engineering consulting practice, on my cloud Confluence I curate one space for each client. When I add myself as a test user (using different login credentials), I was able to see all the clients' spaces upon entry into my site :(  .

How do I curate the client experience to land my individual clients straight into their own space and ensure they never see any other clients' spaces? Obviously, client privacy is critical to get right.

Is there a different strategy that is more commonly followed, such as to buy a confluence license for each client? That seems heavy, but I wanted to ask.

Shawn Doyle - ReleaseTEAM · Accepted Answer

Add groups to all existing (and future spaces) to limit access.

Set it up so that the default groups will no longer have read access to any space you do not want external users to see.  Add all internal users to the new groups as appropriate.

Create a group for external users, and add that group to spaces you want them to have read access to.

Iain Davidson_yg75xq · Accepted Answer

I have a very similar situation where I create a login for a specific Jira project.
example: Zaphod Beeblebrox

This user should see only their Jira project and no Confluence pages.

But other existing Confluence and Jira members can see the project.

So I created two specific groups for this Project.
example: heart-of-gold-project-users, heart-of-gold-project-admins

And put in the specific project user and only those other users who need access.
example: 
heart-of-gold-project-users: Zaphod Beeblebrox, Ford Prefect, Trillian, Arthur Dent, etc.
heart-of-gold-project-admins: Douglas Adams

I updated the access permissions on the project, removed all groups, and then added only these two groups.

example: 
heart-of-gold-project-users    [User Access]
heart-of-gold-project-admins [Admin Access]

If you already have company groups for the rest of your Jira users and admins, you can also include those.
my-company-users     [User Access]
my-company-admin   [Admin Access]

Manual process, but it's a setup-and-done situation.