User sharing and visibility between internal and external users
Key Takeaway
Lock down first by setting the external org-wide default for User to Private, then open up only the access people need.
User sharing controls which users can see other users' records in the org, for both internal users (employees) and external users (Experience Cloud site or portal users). You hide users from each other by default and then open up only the access people need, so external users can't freely browse or look up everyone else.
What user sharing shows or hides
User sharing shows or hides an internal or external user from other users. Access to a user record makes that user's detail page visible and makes the user appear in lookups, list views, and search.