Kibana spaces

Right, because users don't belong to a space, they belong to the cluster. You can create users without any access to Kibana, and that's a perfectly valid thing to do.