Currently when a pull request is created, the auto-complete user list for possible reviewers will list all users. Ideally only those would be listed here that have access to the specific project.

Especially in enterprise environments or when external people have access to a project, it is crucial to separate users, not even letting other users to know about another set of users.