You just give the users the option to view your blog when you make it private, but don’t actually control the accounts themselves. Each user controls their own passwords. Ultimately, you are just giving the account the right to view your blog.
Have ypu read through all the wordpress.com support documentation?
The privacy options available are found here
-> Dashboard -> Options -> Privacy
Blog visibility: ____ I would like my blog to appear in search engines like Google and Sphere, and in public listings around WordPress.com.
____I would like to block search engines, but allow normal visitors
_X__I would like my blog to be visible only to users I choose
Up to 35 users allowed to access blog. Want more? http://en.support.wordpress.com/unlimited-private-users/