Yes I got caught by that too! so either I'm dumb too or you're not because I'm highly intelligent
Check the Node Tree. Along the line for each Node see "Permissions"
That shows you the list of usergroups to fiddle as you wish.
Top right you can set permission per user.
Top left make it 100% private EXCEPT if you give a permission through this page.