Also another question about permissions. If I create a Galaxy page and share that with limited users then it appears that the datasets are all public via a URL is that correct?

Yes, all datasets are public via URL by default in Galaxy, and a Galaxy Page makes it easy to find this URL. Without knowing the dataset hash id and/or the instance's secret key, it's very difficult to guess a URL that leads to a valid dataset.

To change a dataset's permissions, click on the pencil ("Edit attributes") and scroll to the bottom of the attributes page.

Thanks,