DNN content control works in different ways. For example, modules are shown to the viewers and easily accessible. If viewers have a module(s) displayed, then the public can enter a specific URL in a browser and see the page.
Each module has its display settings available on-page. Viewers can edit or view the module as there is an option available in settings to the checkmark or not, meaning giving accessibility or not. The settings are displayed in a grid with checkboxes corresponding to earch user role where if you checkmark any options in settings, then those specific categories would be able to hold control and edit/views the content. If you don't checkmark any option, then all controls are limited to Administrators.
Administrators would easily access the modules and if it's "On" then it won't lock everyone out of the module. The administration group is default "On" so it has access to the module. You also have the option of Inherit view permissions from the page, which can set the module setting to inherit permission from the existing page via the checkbox on the permission page.