Here is a breakdown of the architecture: http://docs.jivesoftware.com/jive_sbs/5.0/index.jsp?topic=/com.jivesoftware.help.sbs.online_5.0/developer/ApplicationArchitecture.html
Projects live within either a space (many permission options) or a group (open to secret). The projects inherit the permissions of their parent container. So if you did have a space that allowed customers in, you could share projects with them in just that space. All other spaces would not be visible to them.
External communities are just configured to allow guests in and have different settings when it comes to registration, profiles, content creation, etc.