Liferay itself uses search extensively and users are simply indexed. So, they are always available to search and can be found. To make sure that no users are found, it is actually necessary to add a"no users" term to the query (or have a whitelist of asset types without users).
When you search: Do you search as an admin or as a guest? Users should not be viewable for guests/other users by default and therefore not found (except by the Administrator, of course). In any case: Permissions are probably the only way to do that in 7.2 (and usually the best/correct way too).
In 6.2 you could simply remove the users class line from the facet configuration. I actually don't know how to configure that for 7.0+, we have never used the builtin search, we have our own search module with a vue.js frontend, typeahead and so on and use that instead. The two main issues for us were that it was a hassle to change the results display (mobile behavior was bad too) and that we had no control over the search parameters (some clients had very specific requirements here).
We probably need to evaluate this strategy for 7.3+ since there templates for search results were introduced. But the usability of our component(typeahead and all) looks still better.
