Currently default access for Jira Work Management projects is the to "Open". A site administrator should be able to enforce all user-created projects to "Private" by default.

This same feature has been requested for Jira Software, but as Jira Work Management seems to be considered a separate product, rather than a next-generation project, I am opening a separate feature request for the same.