Delimit access for jira spoke

[Bo Schlichting]

Hi Community

Hope there are some sharp minds out there, who can guide me here. :)

We have a large customer who wants to setup integration between our Jira and their ServiceNow. They want to use Jira Spoke for this.

We have therefore created a user and created an API token, but when we test with usage of Postman, can we see that they with the user can see all our projects even though I have added the user to one organisation.

So the big question is how do we restrict the users access as I need to use an Atlassian user, as JIRA spoke requires this, but at the same time I need to restrict the users access rights to a certain scope, limiting projects and issues within projects.
Any advise is very welcome.

Thanks

Bo