What's the maximum level of privacy a user can get within the site?

No further.

Afaia, Discourse has basically two modes of user privacy, full closed or open wrt user profile routes. Users might choose to hide their profiles individually but cannot discriminate by user?