I've set up a client who only has access to Jira Service Desk (Cloud)

And when they view a task with an internal and external comment, they can only see the external comment - which is what we need.
However, in the browser, they can change the url to xxxx.atlassian.net and get access to Jira - which allows them to see this:

Here the internal and external comments are available to view. How can I prevent the user from accessing Jira - I was hoping that just having "Jira Service Desk" ticked would prevent access to Jira?