Summary:

Confluence connected with JIRA as user management, once you set-up the directory, you'll see that those users will show up there, even though they doesn't have Can Use permission nor belong to confluence-users group.

Our documentation:

https://confluence.atlassian.com/display/DOC/Searching+the+People+Directory

The people directory displays a list of people who are authorised to log in to your Confluence site.

The people directory includes anybody who has logged into Confluence or who has had a user account created for them in Confluence.

The people directory does not include users who can log into Confluence using external user management if they have never yet logged in.

Steps to reproduce:

1. Have a test user, that belongs only to jira-user group.
2. Create a JIRA User server in JIRA.
3. Connect with Confluence.
4. After connect JIRA to Confluence as user management, check the people directory.
5. You'll see that the test user is there, and it doesn't have access to Confluence.