Can you have multi-site WP and keep users separate?

I don't know if there is a way to have fully separate users (where you can create a new user with a username already taken on another website) but it is possible to not reveal other websites to your users. However the users of a website are not used on another website (except the administrator) unless you use the feature "Add Existing User", so it is not possible to know users of other websites by using a URL like /author/username.

By default, WordPress leaks other websites which is not good for privacy I think. I had to configure the password reset link to stop leaking the primary website, see Password Reset for Users on a Multisite Subsite.

Also I used the plugin WP Mail SMTP to configure the From email address of the default PHP mailer to use the website domain name because it was leaking the primary website domain name.

And when using BuddyPress, I had to uncheck the option "Show the Toolbar for logged out users" because the WordPress logo was leaking the primary website URL. However BuddyPress will display users of other websites even if you did not add them to your website (if they tried to log in on your website), when visiting the URL /members.

It is also recommended to disable directory listing on your web server, otherwise people will see all the files of other websites in your uploads directory (this does not prevent people from guessing and finding uploaded files of other websites).

If you successfully log in to a website with the username only used on another website or both websites, it will disclose the other website URL in the menu My Sites. But if your username is not added to the website, you will not see other websites.

An advantage of using multisite is that you will not have WordPress core files duplicated for several websites. To avoid people finding other websites on your multisite installation, I would recommend checking after each update if there is no leak. In the end, it is like using the VirtualHost feature of Apache, there is always a risk that a hacker getting unauthorized access to one website, gets access to other websites on the same server.

Here are other interesting questions about having multiple websites with the same WordPress core without using the multisite feature:

Can we use one WordPress installation for multiple databases, domains and content directories

https://stackoverflow.com/questions/8794063/leaving-wordpress-core-files-untouched-shared-between-multiple-blog-installation

No, in a multisite, all sites have the same users table and user meta.

Keep in mind if you did manage this though, it would be trivial for them to find out it was a multisite based on code, and they could very easily break out of their site.

As an aside, you could run filters to strip out everything that makes multisite multisite, and make the user tables separate, but:

• now the only benefit is that creating sites is easier
• Network admin roles and capabilities will be broken
• Any plugins or themes that do anything remotely related to multisite will reveal the truth, unavoidably
• The entire setup would require ongoing updates and maintenance to fix issues
• Plugin compatibility problems and bugs
• Issue with cookies and domains
• The Network admin user panel would be useless if not broken
• Any plugin that uses switch_to_blog could cause data corruption, including navigation in the network admin
• A lot of additional code would need writing to setup new users etc, and create the existing tables with the new prefixes
• Every user related API would need modifying

I estimate at least a months worth of work from an experienced developer, with an extended maintenance contract. Longer for the average developer, with no guarantee it will work well.

Or you could write a script that lists WP instances and lets you download and install new ones. Better yet, use WP docker images and provision them automatically.

This is a classic XY problem. You have a problem "How do I spin up WP installs quickly so I can resell them", but rather than ask that question, you devised a solution and asked how to implement the solution instead