My understanding is that anybody who knows the link like bbbserver/xxx-xxx-xxx-xxx/join and knows the access code can enter the meeting. Isn't that correct?
I see, the story has many sides. Our BBB provider won't give access to the Moodle site. So we can't use the BBB plug-in. Instead teachers get their own meetings in the form bbbserver/xxx-xxx-xxx-xxx/, which they can configure it many ways. I've mentioned the way I use it: Add the URL bbbserver/xxx-xxx-xxx-xxx/join to the course and share the access code with the participants.