It’s not entirely obvious that you can publish a workbook into one Project in Tableau Server, when the workbook connects to a published datasource in a different Project, but it’s actually best practice. As long as the creator has access to both, it will work just fine, and the end user only needs the regular view permissions on the workbook to see all of the content. This lets you keep the datasources hidden from the end users. Keeping the datasources in their own project helps content creators know which datasources are available and gives a single location for managing everything.
There are a lot of good reasons to use Published Data Sources, but one that is particularly important is that in a workbook with a direct data connection (that is, not using a published datasource on Tableau Server), when a user chooses “Edit”, they will be prompted to enter in the database credentials. When the workbook is connected to a published datasource, there will not be any prompt, if the user has Connect permissions on the datasource. This means that the credentials for the published datasource should look like this to allow web edit for the users who cannot see the data source.