Found out that the schema objects have select grant to public, that is why the new user was able to select the data from the existing schema even though there was no explicit grants made to the new user.