External User (Review license) Permissions

We want to give limited access to people in other organizations that we collaborate on projects with, so that they can see timelines for projects in which they are involved. It appears that the External User access level does not allow access to projects, so we've created a custom Reviewer profile with very limited access to accommodate this. To ensure that they only see what is intended for them, we've been adding them to a company and then sharing a project only with that company. However, I am afraid that there's still the potential for them to inadvertently see other internal projects if someone makes a project "visible system wide," for example. Can that setting be disabled, or are there other stopgaps in place that can prevent accidental sharing of information with external users? Thank you! Ellie Naumova Project Director Contributor Development Partnership, PBC