Here's another question that I often get: How can I control which Team Projects a specific user can see in TFS?

A: In TFS 2008 this is the default behaviour! New projects will only be visible to the members of the project groups.

In TFS 2005 there's a different story. Here the behaviour is that all valid TFS users can see all projects. That of course won't give them rights to do things in the projects, but having a long list of projects can be confusing. The solution in this case is to create a role (i.e. "Denied users") with "View project-level information" set to "Deny".