Make projects visible only to users with permission to see them.
Don't show projects that a user doesn't have permission to see.
Restrict reading tickets to correct project scope.
Restrict creating tickets to only users who have permissions to do it.