DB user should not be able to find the other user names in the instatnce

[reydp]

all_tables will only show tables that a user have been granted with privilege either directly to a user or thru role. query the dba_tab_privs:
select grantee, privilege, table_name from dba_tab_privs where grantee = 'YOURUSER';
or the role that being granted to the user:
select grantee, granted_role from dba_role_privs
where grantee = 'YOURUSER';