If you want to share a file or folder with a user who doesn't have access to SURFdrive, you will have to use the "Share link" option. SURFdrive will generate a "public" link to the share, which means that everyone who knows the link will be able to access your share. In principle, this also means that if somebody accidentally guessed the link, he or she will also be able to access your share, even though you didn't tell him/her of your share. To make sure only certain people can access your file/folder, you can protect the link with a self-chosen password.
In addition to password protection, you can also set an expiry date. This renders your shared file or folder unavailable from a certain date onwards.