The statement in the Sitecore documentation is somewhat misleading. Publishing your content to Experience Edge does NOT expose that content to the public. The Experience Edge endpoint requires an API Key/secret to get content and that API Key/secret should never be exposed to the public. Do not ever directly call the Experience Edge end point from client-side code, obfuscate this behind an API.
The users and roles in the Sitecore CM, should never be used to provide logins to your delivered website. This has been done many times in the non-headless world, but it is a bad practice and leads to user stores that do not scale well and can make it harder to administer your CM users too.
You should keep your authentication for your CM users separate from your website users.
For headless applications, your head application (Next.js/React/ASP.NET Core etc...) is entirely responsible for securing any part of your website. Each framework has ways of doing this so I will cover principles here vs concrete examples. But in general, you can explicitly secure parts of your website via hard coded methods, or you can use data from the CM to decide how to secure that data.
You should use an auth provider to provide authentication/roles etc.. (e.g. Auth0, (Firebase)[https://firebase.google.com/] etc...) and integrate that with your application.
If you want to control what is/isn't visible to users, you can easily create a field on your page templates to identify who can see that page to your head application. But its up to the head application to obey those rules.