A user should be able to itself as public or private.
If private, another user should not be able to automatically follow them, but instead, would have to request to follow the private user, and the private user would have to accept the follow request.