Just a clarification - on further reflection in Scenario #1 it was using the program enrolment method that may overrides the course visibility settings (so not hidden categories). We had a course page visibility = No users but the course was listed on the program (as 'Coming soon'), and the learners could access it. We had to hide the Program enrolment method so they could not access the course.
Hopefully this makes sense.