External Users and Security Access to Internal sheets

Can external users view internal sheets?

Say someone outside our organization submits their bid, they get a notice that their bid was rejected and it gives them the link to our internal sheet. (see sample)  I have only tested this using my own email address, so maybe they can’t see our sheet after all? If not the case how can I avoid that?  I do not want them viewing our internal bids or anything on our sheet.   They are not shared to our sheet however they provide their email address on the form.  I use that email address to notify them for various things. Thanks