Thanks! I tested a modified access level that removed the "automatically inherit document permissions."
This prevented the user from seeing any documents in the project, which is good for our 'curious' folks.
However, when the user was added to a task, they also did not inherit document permissions -- which is a problem. Task owners need to be able to see the project documents.
Also, when the test user was added to the proof for review the document was not automatically shared with them.
I take this to mean we'd have to add them to the proof and manually share the document with them to allow them access?
If so, that's unfortunately not tenable for our workflow due to high user volume per proof.