Otherwise clients or contractors get access to the full suite of docs when they accept and there is no way to change this without continually checking whether they have accepted and adjusting the role after the fact. Ideally we can set which role is assigned before the invite is sent out.
This is an important point. If cannot assign the role/workspaces before the invite, the other option would be to have no workspaces/team assignment at all be default and notify admin that invitation was accepted/user created, so that admin can go and assign role/workspaces as needed.
By default, a new user will be invited to the Team Members group. You can go to a space settings/team acces control and not include Team Members. So every new user will not have acces to spaces you do not want to, until you move them into a specific group you created(sales, engineering, dev, etc).