If user have "Browse Users" permission then can see all users in watchers suggestion list instead of only users from this particular project.
Adding user apart from project is not possible (message "User doesn't have permission to this project" is displayed) but usernames are visible.
This is problem for us because we wouldn't like to show customers other customer names.

I've created another issue JRA-37551 which in our company scenario are related to each other.