Hi @Shawn Gittens
Did you add these external users as guest users?
If so, according to the documentation: After a bot is added, bots and guests can communicate with each other.
To avoid guests from accessing bots, you can create more app setup policies, assign them to internal users, and add bots with the custom policies.
Pin the app to internal users' Teams but not to external users' Teams.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.