Thank you! In Cloud, users are created via
the APIs, and added to the domain. Access to workspaces is done separately, as explained in the article
Manage Workspace Permissions. That way, users can only access workspaces they are explicitly allowed to.
Note that User Groups are also used to provide access to workspaces, so you will want to avoid making the user a member of any groups that have access to other workspaces.