By default all users in your organization have access to all projects. You can restrict them to have access only to projects they are assigned to.
To turn this on you should go to Edit Organization page and change "Project access control policy" setting from "All projects" to "Assigned projects".
|Access Control Policy||Description||Best used for|
|All projects||All users in the organization have access to all projects, sprints and tasks. Assigning a user to a project is only necessary for that user to be able to own tasks in that project.||
|Assigned projects||Users only have access to projects, and sprints and tasks in those projects, to which they are assigned. Assigning a user to a project is necessary for him to be able to access it.||
Please note that only users with User and Guest roles can be restricted to projects. Admin users will still have access to all projects in the organization.