I create a local mounting point with CBFS_SYMLINK_LOCAL | CBFS_SYMLINK_NETWORK combination of flags. Why is such disk visible via Network Neighborhood?
When the mounting point is created with CBFS_SYMLINK_NETWORK, it consists of two parts - optional disk name (either drive letter, eg. Z: or a "hidden" mounting point) and a UNC name, a mandatory network path which consists of the server name and the share name.
CBFS_SYMLINK_LOCAL flag affects only the disk name. If the flag is set, the "disk name" (drive letter or a "hidden" mounting point) will be visible only for the specified session.
"UNC name" is always globally visible and accessible for all sessions. Yet you can hide it from being seen in Explorer and further prevent access to the disk from different sessions. The mounting point can be hidden by specifying CBFS_SYMLINK_NETWORK_HIDDEN_SHARE. Access can be controlled and forbidden by checking session ID in the OnCreateFile and OnOpenFile callbacks (then, if the session isn't allowed to access the mounting point, your code should return ERROR_ACCESS_DENIED error).