In the Space Privacy Extranet Configuration you can define some important settings that will effect all extranet spaces you create.

Scroll down to see details of every setting. 

Who can see and find users that are not assigned to an extranet?

You can choose wether users who are not assigned to an extranet should be visible for other users or not. By selecting "Global and Space Administrators and Extranet User Managers" only those user types have access to all users. In this case Extranet users can only see Extranet users who have access to the same extranet spaces. 

By selecting "All users" they can see users who are not part of an extranet space, e.g. internal employes. 

You can select whether Global Admins, Extranet Space Managers and Extranet User Managers can create new users in the extranet space administration. 

This option is deactivated by default, which only allows for adding existing Confluence users (and LDAP users) to an extranet space. 

You can define if Extranet Space Manager and Extranet User Manager are available to assign to an extranet space.
Only the selected admin roles will be displayed in "Create Extranet Space" window and in the Extranet Space tools.

Extranet Space Managers are able to assign users and groups and also have space administration rights.

Extranet User Managers can only assign users (no groups) to an extranet space. They don't have any rights to administer the space itself.

It is possible to decide which initial permissions should be available in extranet spaces for extranet users. For now it is not available to set custom permissions. 

You have to click on the "Show restriction details of predefined roles" dropdown to see the full list of role details.

Assign User with initial roles

Above you can see which groups are built by creating an extranet space. There is a group for each initial permissions role.
In the Space tools you can assign users with the initial roles you set up in the Admin Configuration.