Anyone with who you share your venue URL with will be able to access the space. Each url contains a hex, so it's highly unlikely someone can 'guess' a venue url.
You can add all people in your organisation as members (read below), and set the venue to 'members only' to restrict access to people within your organisation, if you so choose.
Members and Permissions
There are 4 types of users for any Cosmos Venue. The venue creator (primary owner) can go into settings --> venue access.
Here, they can control who has access to the venue, and what permissions they have.
Members: Regular part of the space, but cannot add others, change the venue or venue name. Can't invite others into the venue.
Admin: Can't add other admins, but can add members and guests. Can also make the venue members only. Able to change the venue and venue name.
Owner: Can do everything and admin can, and is able to add or remove admins.
Primary Owner: The venue creator. Can add admins and owners. Person responsible for billing, in addition to being able to do everything an owner can.