How to control to whom email can be sent
JETI allows you to impose restrictions on recipients of emails in multiple ways in the "Restrictions" section of the Configuration page.
You can exclude Roles, Groups or Fields from the recipient dropdown fields to avoid accidental broadcast of emails. E.g. you may want to exclude the jira-users group, so that noone is getting tempted to email all users.
These restrictions do not mean that users cannot select individuals who are member of these groups/roles/fields as recipients. Rerstrictions simply remove the selected entities from the recipient lists.
By enabling the option "Exclude external recipients" you can make sure that emails will not be sent outside the scope of your JIRA users. Even if an email address is specified manually or stored in a custom field, no emails will be sent to that address unless it belongs to a JIRA user.
Limit to Project User Recipients
By enabling this option, you can make sure that only those JIRA users will receive emails who are authorized to view the issue in JIRA. This means who have the "Browse project" permission for the project of the issue.
The ultimate solution to fine tuning recipients is the Recipient Whitelist. It is a list of regular expressions. Only those recipients will actually receive the emails whose email address matches at least one regular expression.
E.g. to specify that emails can only be sent to domain mydomain.com, enter this expression: .*@mydomain\.com