I keep @mentioning the wrong users in our private repository's Issues. What's actually happening as a result of this? Is github 'clever' enough to determine that those users don't have access to our repo, or are they receiving annoying irrelevant notifications?
When you @mention an user within your private repository issue who isn't part of that repo, Github is clever enough to assess their lack of privileges in that repository and hence doesn't notify them in any way.
You can confirm this by typing the wrong username into "Assignees" column, and see that Github doesn't even populate any user account that isn't part of that private repo.
In fact, your action of wrong @mentions has the same effect of mentioning an invalid user account. The only difference is, when there is an existing Github user by that username, their profile is hyperlinked in your issue.
This could actually be seen as a feature when, you would like the expertise of someone in an issue, who isn't already a part of the private repo. By hyperlinking their account, it makes it easier for other collaborators to check their profile before giving them access to the private repo.