4
They don't get access to the admin side of things, everything is done on the front side of the site. If users are logged in they have the option of uploading images to designated Photo Albums, but again, only if you set the permissions for it.
I have XCG running on my bodybuilding website. You can register for a free account if you like and see how it works from a users point of view.
http://gaining-mass.com/modules/xcgal/