In Settings - Permissions the "Default Logged-in Permissions" options are not working in this scenario:

A new created project has "No access" as default, only allowing the Individual Users and Groups defined below to access the project. (That works fine)

If we set "Default Logged-in Permission" to "Read" this allows any user member of stash-users to read the project. (That works fine too)

Problem is the "Read" permission cannot be revoked, setting the project back to "No access" has no effect, all users that can login to Stash can see that project.