this was reported by a customer and i've reproduced on 2.3.3. it's unclear to me whether or not this is expected functionality.

from the customer:

Once I hide the template (remove the group from template permissions), the workspace is also gone from user's UI, and they can't connect to it either. What we expect to happen is: users cannot see/create new workspaces on the old template, BUT existing workspaces can still function as normal (i.e start/stop), and users can still connect to it.