This is probably the default permissions.
Your users will have been added to a group that says "can log in". This group is probably also being used to provide "browse project" in the permissions.
You'll need to unpick that if you want to restrict them - create a new group or groups separate from "can log in", put the right people in them, apply them to the project roles to replace the login group and remove the login group from the project roles.
Hi Community! The Jira Service Desk marketing team is looking for customers who have successfully switched from Zendesk to Jira Service Desk! We’d love to hear your thoughts on the pros and ...
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs