Hi,
Whenever I create a new user via non sso or sso, I ONLY grant them JSM Customer product access so that they can view on portal. Sometimes I grant Jira Software but whenever I do that, it allos that user to Administer Jira and view, create, edit all exisiting projects. When I look under global access settings, I don't see a group that matches for that user that would be allowing for this to happen. There is a trusted users groups that shows but when I click view users it doesn't even list that in the groups page. The user is in two groups but those are what assign his product access but once they login, they can see every single project in my site. Please see screenshots. 
