Correct, when project administrators add users to groups in their project, new users will get added to the system if they don't already exist.

Note that your project administrators can also impersonate their project users to verify permissions, etc. We are careful to limit all access to the current project and don't allow project administrators to inherit any site roles (e.g., site admin, developer).

Adam