Are portal users separated from protected administration?

Yes. Portal identities remain focused on operational booking work while protected administration is reserved for authorized platform control.