This was one of the larger hurdles for me as an admin.

Rooms are their own discreet entity. While they may be organized into your space, they exists as their own thing.

So properly setting who can and can't create rooms is crucial. If I'm allowed to make rooms in your space then absolutely I can make a room that you're not the admin in. You'd need to remove it server side if that's a thing you needed to do.

Spaces aren't even exclusive. You can link in rooms from other spaces and they can exist in their original space as well as the new linked one.

As far as users seeing rooms, if the rooms are set to visible for space members then they need to join the space. Once done they can see them from the space's home.

The Matrix.org page touches on the basics here: https://matrix.org/docs/communities/getting-started/

If you want to create a space that propogates permissions, then you there isn't a way to do that built into the spec. Because like the other person said, spaces are collections of rooms. They don't control those rooms.

However, there are multiple bots written that can do something like what you want. Here for example. Essentially you make the bot the admin, and then only create rooms, etc, through it. And it will create things with the right permissions

Edit: This flexibility in space vs room permissions can also be seen as a cool thing in some ways. It allows you to do some things that wouldn't be possible under Discord's model. For example, maybe one room of a different community is really relevant to your community. You can directly include that room in your space and then all of the space members can see it and chat in it without joining the other community. Or you can even include their entire space inside your space.