Security issues - sharing reports with external users - potential breach concern

Hi - 

A client has shared some power bi reports with external users.

As a result, these users are now registed as guest users on the client's AD tenant.

During the sign in process, once the external user has authenticated, they come to the https://account.activedirectory.windowsazure.com page for the client's AD tenant...  this shows that they have no apps - but it does show the "Groups" logo.

External guest users can click this and are able to see all of the groups in the organisation - but more critically when you click on a group you can see all of the group users and their IDs (email addresses).    

Anyone know which settings need to be shut down to prevent this?  Obviously we don't want external guests to be able to see email addresses of other users.