True, when ever a new user is created it is added to public role by default. While creating a user if you set it for the particular db access he/she can access that particular database only (including system databases). Refer http://www.databasejournal.com/features/mssql/article.php/1478701 or BOL for more information on this.
Hemantgiri S. Goswami | MS SQL Server MVP
-------------------------
"Humans don't have Caliber to PASS TIME , Time it self Pass or Fail Humans" - by Hemantgiri S. Goswami
http://hemantgirisgoswami.blogspot.com
http://forums.surat-user-group.org/

Disclaimer: This post is provided as is, for the sake of knowledge sharing only.