So I have OG Forum enabled. I've noticed that users who can't access a certain og forum container can still subscribe to it through notifications. Not sure if they'll actually get a notification though, but even if they don't, I rather not have all those forum containers visible in the UI.

So I installed a fresh drupal site, installed latest versions of notifications, messaging, og and og_forums. Created two new groups, made both private and closed. Enabled notifications and messaging, enabled subscribe by tags with forums as an enabled tag. On the notifications UI settings, I made tags visible and set permission 'maintain own subscriptions' for authenticated users. User 2, who has no access whatsoever to any group, can see Group A and Group B forums on the tags page.