Thank you for all the advice I think Frank1940 hit it I just don't understand the structure of what I'm doing, I'll read up on it more. For me I thought public meant anyone within my internal network and anyone coming in from the outside I could restrict that clearly isn't the case.
I set up a user for eventually letting a family member view jellyfin media through tailscale and I wanted to restrict their access to media only but on the list of shares under the user they all say read/write access with a dropdown that has no other option then read/write? Do I need to turn off PUBLIC from each share to get an option here? If so will it cause my windows machines inside my network to have to submit a name/password to use that share? Thank you.