Nextcloud is just a web service. How he or anyone can access it is not determined by nextcloud but by the routers, firewalls, vpns and potentially reverse proxies that are routing the traffic to nextcloud.
With the proper configuration of all traffic handling services it will not be possible to access anything other than the intended endpoint i.e. nextcloud.
Within nextcloud any user can only access their own files plus anything that is explicitly shared to them.