You will need to review all the projects they should not have access to see how they are getting access to it, and then remove that access.
Generally, the group jira-users or jira-software-users has been used to grant access to all projects to anyone who can log in. You'll need to change that model, adding a new group and removing the "can use" group from the projects.
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG