This related to public and private connections.
access to metadata in a catalog can not be managed separately from access to the actual data. As soon as somebody has been granted read access to a catalog or an asset in a catalog they automatically get access to both metadata and data.
If a user has access to a data asset / data connection in the Catalog they are automatically able to either read the data in COS or to use the data connection to connect to the underlying data source impersonating whichever user was entered when the data connection was created.
So if Bob creates a data connection to BigSQL using his credentials and shares that data connection in a Catalog or Project with Alice then Alice will be able to log into BigSQL with Bob's user id.