Access Nothing vs Access Everything Security Model

Can someone share how to configure suitecrm in a default access nothing configuration?

I have followed the securitysuite guide to create a team1 and team2 and lock access to contacts down to each group, however when I create a third user not in those groups while they cannot click on search results to access contacts or accounts they can see them in the search list. Is that something that requires the Pro version?

have you imposed any restrictions on the third user added them to another group?