This is expected behavior, Service Portal is designed to be modular with portals themselves having landing pages and links out, but pages can theoretically be viewed within any portal and don't belong to any specific one. This is a good thing, because it means that if you do want to use a page in multiple places you don't have to create multiple pages.
What's happening here is a smart user, who knows the system, is exposing a flaw in your security position. If you just don't want them to be able to see this page, but it's not a problem for them to see incidents per se, then create a user criteria and add it to the page. If they shouldn't be seeing incidents at all then you need to check your ACLs. The page is ultimately just another UI, the same base rules apply and if they can see something here they can likely see it somewhere else.
