basically projects are used for managing the entities which will help users to export and import as that would happen in bunch.
Projects are used to organize entities within ThingWorx. Entities that are collected in projects can be exported and imported together. An entity can belong to only one project.
You can refer help center link for more details on projects
http://support.ptc.com/help/thingworx_hc/thingworx_8_hc/en/#page/ThingWorx%2FHelp%2FComposer%2FThingWorxProjects.html
now coming back to your scenario, here project won't come into picture. though you can use for good structuring the entities. In your case here,
first you need to provide all collection permissions on entities ( things, thing shapes, thing templates , mashups etc) to both the users so that both users are able to create and manipulates with those sets of entities . now to restrict one of the user from for ex one mashup . open the mashup , go to permissions-- in runtime and design time permissions add the user and use deny ( cross buttton) options to set those. in this way the user who is restricted won't be able to do anything with mashup. but keep in mind all users would be able to view entities because there is no such option to deny the visibility. but runtime and design time would work. restricted user once clicks on mashup to view/edit -it will show unauthorized error pop up.
i hope this clears and helps.