Portal users are the people you work for. They sign in to your portal, see their own records, and never enter your workspace.
Portal users are managed separately from your team, under the portal's own user settings — not under Settings → Users, which is for colleagues.
Invite them by email; they set a password and sign in at your portal address.
Only records that belong to them. A client sees their projects, their requests, their documents — not another client's, and not your internal work.
That scoping is the entire point of a portal, so it is worth stating clearly to your team: putting a record in a portal-backed sheet does not expose everything on it. What appears is what the portal is configured to show.
Portal users are not workspace members and take no seat. An agency with five staff and eighty clients pays for five.
Open the portal yourself as a test user first. Check that what you see is what you intended — that is a five-minute check, and much better than discovering the answer from a customer.
Remove a portal user and they can no longer sign in. Their records stay exactly where they are; only access ends.
Related: What is the client portal? · Roles and permissions · Seats: adding and removing people