When a username is mentioned in a thread the user can not see, the mention should be rendered with a disabled style. The plumbing for this should already be implemented, and this should mostly require calling setContextObject() on RemarkupEngine. See T4411 and D11049 for the implementation in Maniphest.

The goal is to show the thread participants that a user can't see the thread, so they don't expect the user to respond or receive a notification.