This is probably the default permissions.
Your users will have been added to a group that says "can log in". This group is probably also being used to provide "browse project" in the permissions.
You'll need to unpick that if you want to restrict them - create a new group or groups separate from "can log in", put the right people in them, apply them to the project roles to replace the login group and remove the login group from the project roles.
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events