Yes, if the user has permissions they can clone without using the website. They will need to know the repository URL or workspace ID + repository slug.
Here is some additional documentation for cloning repositories using git: https://www.atlassian.com/git/tutorials/setting-up-a-repository/git-clone
If someone can clone a repository, then they have access to view the commit history. By cloning a repository, they are downloading it to their computer. That is how git works and not unique to Bitbucket Cloud.
A user cannot have read access to clone a repository without having read access to the repository on the Bitbucket website - the same information (the git repository) is on the computer that cloned it and the Bitbucket website.
The types of access a user can have are read, write, or admin. There are also more specific types of rules that can be configured at the branch level.
Does that help?
Hey Community! We’re willing to wager that quite a few of you not only use Bitbucket, but administer it too. Our team is excited to share that we’ll be releasing improvements throughout this month of...
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events