@ak00001 This is a really good catch. The “course visibility in catalog” setting is not taken into account because the COURSE_CATALOG_VISIBILITY_PERMISSION and COURSE_ABOUT_VISIBILITY_PERMISSION settings are incorrectly set to the legacy default, which is see_exists. Instead, these settings should be:
COURSE_CATALOG_VISIBILITY_PERMISSION = "see_in_catalog"
COURSE_ABOUT_VISIBILITY_PERMISSION = "see_about_page"
As far as I understand, the native Open edX install is also affected by this issue.
Note that changes might not be immediately viewable, because of caching. Also, remember that logged-in staff users will always be able to view all catalog courses, as well as their about pages. Finally, I did not manage to hide courses from the course search (http://0.0.0.0:8000/courses). It appears this does not use the course catalog visibility setting.
This will be fixed in the next release (3.8.1).