I discovered that (AC21 have tried older) a user with server/project admin rights can join any project!? We will do some projects with strict rules regarding access (only the very few that will work on the actual project can have access). If I'm right that it's not possible...does it work with BIMcloud?
Yes, on BIM Server if a user has at least Project Administrator Management permissions, he is able to see and join any of the projects. It is by design setting for Simplified Permission System what BIM Server uses.
However, on BIMcloud it is possible to use the so called Detailed Permission System, which allows you to configure more precisely what your users can access. For further details I would suggest to contact your local distributor.