I brought this up in a thread in another subforum (View just free busy as calendar?) but I'm afraid it might be buried there.
Basically it seems there are two ways to share your availability info with an external user. The first is to right-click on your calendar and share it through the dialog box. This lets the other party access your full calendar details, available in .html and .ics format.
The second way is to just point people to http://<zimbra_server_name>/home/<username>?fmt=freebusy This shows a monthly view of the start times when you're busy. Optionally you can terminate the URL with ?view=week&fmt=freebusy to see blocked out free/busy times for the week. Or you can terminate the URL with ?fmt=ifb to get .ifb format, usable by Outlook.
There are two problems with this. First, unless I'm mistaken, there's no way to restrict unauthenticated external access to free/busy on either a domainwide basis or account-by-account. On the surface it seems there's not a whole lot an outsider could do if they have access to your free/busy, but it still strikes me as something over which administrators and users would like to have control.
Second, assuming one were somehow to turn off external public access to free/busy, there's no facility, when sharing your calendar with an external user, to limit them to just your free/busy information.
This is really what I would like to be able to offer. An acceptable interim solution might be to just protect public free/busy with a common username/password. That way I could at least keep snooping strangers out while giving users a way to tell their colleagues how to access their F/B.
Is this already planned as an enhancement or should I file a bug report/RFE?