Issue Summary

Now that customer permissions are exclusively on the customers tab, there is no way to automate provisioning of customers with Atlassian Access for closed help desks using provisioned groups, a workaround exists but the portal-only users who are also Jira Software users will still be capable of seeing all issues internally, even not reported by them.

In cases that the users are agents for other Service Desk projects, that will give them power to edit the issues from projects they should only be customers.

Workaround

https://community.atlassian.com/t5/Jira-Service-Desk-articles/Creating-the-Service-Desk-Customer-role-on-Next-Gen-for/ba-p/1363580#M279

There is another workaround to achieve this using REST API: https://confluence.atlassian.com/jirakb/add-a-group-to-service-desk-customer-role-in-a-team-managed-jsm-project-1235851188.html 

Suggestion

Create a role that has special permissions for portal-only usage or improve the customers tab to accept Jira groups.