Only privacy rules that'll block them from being visible on a userlist entirely is Profile Privacy. Other privacy rules only take effect during a search.

Ah, ok. so if I give a user the option to make their entire profile private? connection or connections of connections, etc. basily means they won't appear on the list (if private)?

Correct.

If so, then I gather that profile privacy would need to be kept to "public"?

Correct.

And if it's set to public, the only way to prevent unregistered users access to the list would be to make sure the menu link is set to a registered userlist?

Yes and No. Be sure to set the "Access Level" parameter on the user list to Registered as well.

I suppose the only other way for users to see other users is if they appear in the activity feed , but I gather they can't connect with them unless those privacy settings allow it.

It all depends on how private you want to allow people to be. For example you can configure CB Privacy to blanket protect a bunch of tabs/fields, but still allow direct access to users profiles. This allows access to send connection requests while significantly limiting what is visible. The direct access parameter is in CB Privacy > Parameters > Privacy > Profile.

Speaking of which, how are items that appear in the activity feed (via CB Activity Menu) affected by CB Privacy. In my testing I see all the activity but the user profile image is necessarily clickable.

If the avatar or formatname fields are protected by privacy, which they aren't by default, they won't be clickable. If the Activity tab itself is protected by privacy, which again it isn't by default, then that users activity won't display to users who don't meet their privacy requirements.