8 March 2024 Update

The product has changed since this ticket was created. In order for a user to appear in the @ mention dropdown now they must have the Browse Projects project permission of a company-managed project.

This is not useful for Jira Service Management projects, however. As discussed in the comments below:

the one big gap that still remains is that there is no control over portal-only customers and that is a big problem for JSM projects. As mentioned in my comment here, we cannot take away the Browse Project permission from the Service Project Customer - Portal Access or it breaks the project. These portal-only users never need to be at-mentioned at all since they cannot receive those notifications and so it is very misleading to users that are at-mentioning these people and they are never receiving the notification.

Request Participants and the Reporter also need different treatment/restrictions in JSM projects since they are really only meant to receive emails from public comments.

The below might be the solve:

Portal-only customers should never be allowed to be at-mentioned
If the permission was separate from Browse Projects, we could make this happen... right now we are blocked (but they should be prohibited from at-mentions by default)
Atlassian accounts can never be at-mentioned in public comments unless they are not listed in the Request Participants nor the Reporter user fields
I can see a use-case for at-mentioning someone not listed in those user fields on a public comment to loop them in for just that comment
should only allow the people that can browse, so that aligns with the new setup
I can also see a use-case where maybe in an internal comment you want to at-mention just a single Atlassian account that is one of the request participants (they might need to know something that the rest of the participants should not be notified about)
But if it is simpler, prohibiting users in these fields from being at-mentioned all together is better than today where they get duplicate emails on public comments

Original description

Using an @-mention will list all users, but it would be convenient to be able to restrict that to certain groups, certain projects or toggle certain users so that they do not appear in this list.