A customer user is set up and only allowed to see "External" issues.
The user is added as project role "Customers" in project "X".
The project got Issue Security Scheme "Customers". (Internal / External)
When logging in as the customer user, you can only see the External issues within this customers project. So this works fine.
The user still has the possibility to browse through all project names within the JIRA-istallation by doing the following: