New box.com tenant but some users already have email associated with other account

Hi, we have a brand new tenant set up, and when onboarding new users several people already had accounts associated with their email. I was able to "invite" them as external users, then convert them to managed users fine. We want a closed folder taxonomy, and have restrict content creation enabled so only admins can create root folders, however the people that already had accounts merged all their old data into the new account. So does this mean that these people get to ignore the restrict content creation? If so is it only the old data? It's a bit confusing